Malware Analysis Report

2025-06-16 03:30

Sample ID 230505-zr95nsgg8w
Target ShippingDocuments.pdf.exe.bin
SHA256 21777e7d8c275e5e9fc22a08172bfd5b9872340f46523df83bf2dd7a4b611dd2
Tags
snakekeylogger stormkitty collection keylogger spyware stealer redline infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

21777e7d8c275e5e9fc22a08172bfd5b9872340f46523df83bf2dd7a4b611dd2

Threat Level: Known bad

The file ShippingDocuments.pdf.exe.bin was found to be: Known bad.

Malicious Activity Summary

snakekeylogger stormkitty collection keylogger spyware stealer redline infostealer

StormKitty payload

Snake Keylogger

Snake Keylogger payload

StormKitty

RedLine

Detects Redline Stealer samples

Reads user/profile data of web browsers

Checks computer location settings

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-05 20:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-05 20:58

Reported

2023-05-05 23:14

Platform

win7-20230220-en

Max time kernel

97s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1336 set thread context of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1336 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1336 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 1336 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 1336 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 1336 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 1336 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tjyThmp.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tjyThmp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D1.tmp"

C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/1336-54-0x0000000000100000-0x00000000001A2000-memory.dmp

memory/1336-55-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

memory/1336-56-0x0000000000310000-0x0000000000324000-memory.dmp

memory/1336-57-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

memory/1336-58-0x0000000000330000-0x000000000033C000-memory.dmp

memory/1336-59-0x00000000043F0000-0x0000000004452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9D1.tmp

MD5 e8c446d36f5ae1bfff0531345a83295b
SHA1 6e4abc04c15c6738ff4564ed5573fddf837966ed
SHA256 8025dcad55b733b28ab3f065a60b6c08847d828981e7a5e857151c26efe752fe
SHA512 188c39163c3eab86ae6f9cf82c1a5f6047a4465fc6d17025cc2628acd3260b71ca5ecb31910b79d765668854314275ee82fa315a0472a362c554b81d7d09e0b9

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8QZ9A0R8PQ2LMBEGUJ9W.temp

MD5 1c756dcc09ba65f4e3c58928abd1c3fc
SHA1 8adf0c8e694aa1768f02d08d20185c566daf05af
SHA256 736b3d403f764a1dc02a94d90801e0e0b27c182b310d60efb6cc23801491039d
SHA512 9b905313f7d6e76f9c2ba0132c0b72b4bf528016e01582d12908139b0bd5970951e992d909aa80278688c8e3165bf6fdc30e17ebb9c2cedca320ae0fe964cca7

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 1c756dcc09ba65f4e3c58928abd1c3fc
SHA1 8adf0c8e694aa1768f02d08d20185c566daf05af
SHA256 736b3d403f764a1dc02a94d90801e0e0b27c182b310d60efb6cc23801491039d
SHA512 9b905313f7d6e76f9c2ba0132c0b72b4bf528016e01582d12908139b0bd5970951e992d909aa80278688c8e3165bf6fdc30e17ebb9c2cedca320ae0fe964cca7

memory/1336-72-0x0000000004380000-0x00000000043A8000-memory.dmp

memory/1552-73-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1552-74-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1552-75-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1552-76-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1552-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1552-78-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1552-80-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1552-82-0x0000000000400000-0x0000000000426000-memory.dmp

memory/652-83-0x0000000002480000-0x00000000024C0000-memory.dmp

memory/564-84-0x0000000002540000-0x0000000002580000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-05 20:58

Reported

2023-05-05 23:14

Platform

win10v2004-20230220-en

Max time kernel

152s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe"

Signatures

Detects Redline Stealer samples

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4336 set thread context of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4336 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 4336 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 4336 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 4336 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 4336 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 4336 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 4336 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 4336 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 4336 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 4336 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe
PID 4336 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tjyThmp.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tjyThmp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp664B.tmp"

C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\ShippingDocuments.pdf.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 164.113.223.173.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 142.145.190.20.in-addr.arpa udp
FR 51.11.192.49:443 tcp
US 8.8.8.8:53 177.17.30.184.in-addr.arpa udp
US 8.8.8.8:53 44.8.109.52.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 140.145.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 168.6.122.193.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp

Files

memory/4336-133-0x00000000007A0000-0x0000000000842000-memory.dmp

memory/4336-134-0x0000000005830000-0x0000000005DD4000-memory.dmp

memory/4336-135-0x0000000005280000-0x0000000005312000-memory.dmp

memory/4336-136-0x0000000005380000-0x000000000538A000-memory.dmp

memory/4336-137-0x0000000005410000-0x0000000005420000-memory.dmp

memory/4336-138-0x0000000005410000-0x0000000005420000-memory.dmp

memory/4336-139-0x00000000081B0000-0x000000000824C000-memory.dmp

memory/568-144-0x00000000025A0000-0x00000000025D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp664B.tmp

MD5 3d42e68b1022069c7c3f55a5e2c1abf8
SHA1 e42b4e5ba01b92ef74a016677ac5516e43ef300c
SHA256 e2caacc4db51e3b693a0434b058e2fc6ced0ec843dacc144a2adab2f503d69a9
SHA512 81b008dc6b9bb7f350eac70ded553469cd44a08f640512171a78e9dd28dea74a3e6f4ba593f828963324495b35ea358327aad57dd1a2cb8d4a8dfabe2a3382cd

memory/568-146-0x0000000005140000-0x0000000005768000-memory.dmp

memory/568-147-0x00000000050D0000-0x00000000050F2000-memory.dmp

memory/4284-148-0x0000000005C20000-0x0000000005C86000-memory.dmp

memory/568-149-0x0000000004B00000-0x0000000004B10000-memory.dmp

memory/568-150-0x0000000004B00000-0x0000000004B10000-memory.dmp

memory/4284-151-0x00000000029F0000-0x0000000002A00000-memory.dmp

memory/4284-152-0x0000000005C90000-0x0000000005CF6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4bzrpftf.rh2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/432-163-0x0000000000400000-0x0000000000426000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ShippingDocuments.pdf.exe.log

MD5 33d62ef2c354f839a8b2b987e6ee41e7
SHA1 d76f64ac411a61f3f232f7f9f7b179bd34042226
SHA256 f6a84062cb11ccf802324692c2c4c48543377cf717d98efd5de695ed6d0a97d9
SHA512 d68a426b2f4646bb45e2267d60680166a8effb9a461e5a07756ba13a3bdf36b27e6e9777d945d03a62362e6976e92214c53ffc7c4f03ec28d3fcfc9a442c5e3c

memory/4284-174-0x0000000006490000-0x00000000064AE000-memory.dmp

memory/432-175-0x00000000051E0000-0x00000000051F0000-memory.dmp

memory/568-177-0x00000000717E0000-0x000000007182C000-memory.dmp

memory/4284-176-0x00000000069F0000-0x0000000006A22000-memory.dmp

memory/4284-179-0x00000000717E0000-0x000000007182C000-memory.dmp

memory/568-198-0x0000000004B00000-0x0000000004B10000-memory.dmp

memory/568-199-0x000000007F150000-0x000000007F160000-memory.dmp

memory/4284-178-0x00000000029F0000-0x0000000002A00000-memory.dmp

memory/4284-200-0x000000007FB90000-0x000000007FBA0000-memory.dmp

memory/568-201-0x0000000006570000-0x000000000658E000-memory.dmp

memory/4284-203-0x0000000007730000-0x000000000774A000-memory.dmp

memory/568-202-0x0000000007960000-0x0000000007FDA000-memory.dmp

memory/568-204-0x0000000007330000-0x000000000733A000-memory.dmp

memory/4284-205-0x00000000079A0000-0x0000000007A36000-memory.dmp

memory/568-206-0x00000000074F0000-0x00000000074FE000-memory.dmp

memory/4284-207-0x0000000007A60000-0x0000000007A7A000-memory.dmp

memory/568-208-0x00000000075E0000-0x00000000075E8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 24f019d2ef7840559841d3caa90cf881
SHA1 25b94cf0cc29f891aeb501a2e57c472ce4566816
SHA256 2e1ce4970ab1703229f9f59fb79d5b3374133766223fbe8ddf738252a3a96284
SHA512 9de888963ceef4c5672fc3b86bab69e1728a41c04d72dc4d2293ea7364193e4ba497183fd02eff10707679554667e23adfad1b250747e719d413a241f21a0190

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/432-214-0x00000000051E0000-0x00000000051F0000-memory.dmp