qakbot | 9e2864977d0e2bf7e8def198db7d3022188cd764519c2f385797a7ca394c2283

Analysis

max time kernel
148s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wong_B.vbs
Size 1.9MB
Sample240519-ca78escd5t
SHA256 798e44b2af6329ac38f144d816096b72889009f44c9d74aefa36c11dbdc5522a
MD5 32432f63ce811f734d1938060fe83b4c
SHA1 e768c6bf965a548f8e8e79413d67998ee5173364
SHA512 d41328ae22eb0768c70567c7759ed9164112c47f4c81ffb3c3b387c0f8fe33b29725d25cd5b8b390c9feca405d9f426cb823ed8ec5b91d7a139ae5de742e9351
SSDEEP 49152:bs87tFIYKrGSBUsthSxelQwz1w9r+U32mIXzTmCc4iMVWS:k
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot spx04 1568039940 banker evasion persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

323.79

Botnet

spx04

Campaign

1568039940

190.120.196.18:443
70.169.2.228:21
189.160.191.239:443
174.48.72.160:443
99.231.208.9:443
12.5.37.3:443
173.178.129.3:443
189.236.138.168:443
67.41.197.173:2078
173.172.205.216:443
76.69.181.244:995
70.164.39.91:443
75.131.72.82:443
189.236.214.160:995
199.126.92.231:995
98.224.57.108:443
72.142.106.198:995
98.186.90.192:995
72.36.14.160:443
75.177.172.209:6882
67.246.16.250:995
186.48.170.241:443
2.50.171.216:443
206.51.202.106:50003
190.120.196.18:465
73.145.189.17:995
187.233.83.86:443
70.72.222.37:2222
67.183.144.204:443
72.213.98.233:443
90.229.145.250:2222
67.71.130.80:2222
69.4.106.254:443
47.23.101.26:990
50.246.229.50:443
137.25.72.175:443
176.157.2.33:443
75.157.194.173:995
67.214.8.102:443
71.182.142.63:443
184.191.62.78:443
207.179.194.91:443
184.144.65.166:2078
68.225.250.136:443
24.111.196.195:443
47.54.254.139:2222
50.46.131.145:443
24.27.82.216:2222
62.46.63.137:995
98.236.87.243:443
189.155.93.73:443
47.180.66.10:995
173.61.181.106:993
189.140.207.38:443
108.160.123.244:443
181.90.124.162:443
69.57.123.150:443
189.166.121.253:443
189.141.181.204:443
187.194.13.173:443
105.246.76.76:995
74.15.32.205:2222
65.94.90.23:1194
70.50.221.166:2222
197.89.78.186:443
75.56.175.129:995
72.16.212.107:995
64.19.74.29:995
162.244.224.166:443
73.202.121.222:443
89.138.118.87:995
47.153.115.154:995
72.29.181.77:2083
104.3.91.20:995
166.62.129.86:443
190.144.81.158:995
50.247.230.33:443
98.254.147.36:443
72.255.200.129:443
190.162.185.190:0
137.119.216.25:443
75.69.3.12:443
217.162.149.212:443
70.53.246.231:995
181.95.185.22:443
73.136.50.9:443
76.64.15.78:2222
187.163.101.137:995
68.174.15.223:443
73.137.187.150:443
24.229.150.54:995
76.71.76.131:32101
189.158.59.81:443
50.78.93.74:995
72.179.13.59:443
73.226.220.56:443
192.24.181.185:443
166.62.180.194:2078
173.16.78.208:443
67.10.18.112:993
206.51.202.106:50002
108.184.57.213:443
181.197.195.138:995
162.244.225.30:443
47.23.101.26:993
47.136.226.219:443
96.22.239.27:2222
172.78.85.20:443
173.176.203.193:3389
68.59.209.183:995
96.20.238.2:2083
65.94.90.23:3389
65.94.90.23:8443
68.83.59.107:443
68.238.56.27:443
64.20.68.35:2222
73.133.46.105:995
47.214.144.253:443
181.126.80.118:443
67.77.162.13:443
108.14.239.97:443
108.55.23.221:443
64.229.192.230:995
111.125.70.30:2222
104.34.122.18:443
70.74.159.126:2222
24.184.6.58:2222
201.152.106.171:995
173.22.120.11:2222
24.180.7.155:443
184.74.101.234:995
76.85.30.25:995
98.165.206.64:443
70.183.177.71:443
76.116.128.81:443
96.20.238.2:2078
50.100.214.10:2222
67.10.18.112:995
12.5.37.3:995
69.70.37.246:465
108.45.183.59:443
99.228.242.183:995
70.166.97.7:465
148.163.2.101:443
181.25.141.71:995
47.146.173.204:443
184.180.157.203:2222
138.122.5.214:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Executes dropped EXE 7 IoCs

pid	Process
3124	FrWqwyW.exe
4312	FrWqwyW.exe
1484	tkkgm.exe
720	tkkgm.exe
2420	FrWqwyW.exe
1344	tkkgm.exe
388	tkkgm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hxtfm = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Gcjuotlci\\tkkgm.exe\""	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	tkkgm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	tkkgm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	tkkgm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	tkkgm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	FrWqwyW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tkkgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	FrWqwyW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tkkgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tkkgm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	FrWqwyW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	FrWqwyW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tkkgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	FrWqwyW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	tkkgm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	tkkgm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	tkkgm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	FrWqwyW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	tkkgm.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4624	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	FrWqwyW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	FrWqwyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	FrWqwyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	FrWqwyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	FrWqwyW.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4808	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3124	FrWqwyW.exe
3124	FrWqwyW.exe
4312	FrWqwyW.exe
4312	FrWqwyW.exe
4312	FrWqwyW.exe
4312	FrWqwyW.exe
1484	tkkgm.exe
1484	tkkgm.exe
720	tkkgm.exe
720	tkkgm.exe
720	tkkgm.exe
720	tkkgm.exe
3428	explorer.exe
3428	explorer.exe
3428	explorer.exe
3428	explorer.exe
2420	FrWqwyW.exe
2420	FrWqwyW.exe
1344	tkkgm.exe
1344	tkkgm.exe
388	tkkgm.exe
388	tkkgm.exe
388	tkkgm.exe
388	tkkgm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1484	tkkgm.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4312	3124	FrWqwyW.exe	97
PID 3124 wrote to memory of 4312	3124	FrWqwyW.exe	97
PID 3124 wrote to memory of 4312	3124	FrWqwyW.exe	97
PID 3124 wrote to memory of 1484	3124	FrWqwyW.exe	98
PID 3124 wrote to memory of 1484	3124	FrWqwyW.exe	98
PID 3124 wrote to memory of 1484	3124	FrWqwyW.exe	98
PID 3124 wrote to memory of 4624	3124	FrWqwyW.exe	99
PID 3124 wrote to memory of 4624	3124	FrWqwyW.exe	99
PID 3124 wrote to memory of 4624	3124	FrWqwyW.exe	99
PID 1484 wrote to memory of 720	1484	tkkgm.exe	101
PID 1484 wrote to memory of 720	1484	tkkgm.exe	101
PID 1484 wrote to memory of 720	1484	tkkgm.exe	101
PID 1484 wrote to memory of 3428	1484	tkkgm.exe	102
PID 1484 wrote to memory of 3428	1484	tkkgm.exe	102
PID 1484 wrote to memory of 3428	1484	tkkgm.exe	102
PID 1484 wrote to memory of 3428	1484	tkkgm.exe	102
PID 2420 wrote to memory of 2228	2420	FrWqwyW.exe	115
PID 2420 wrote to memory of 2228	2420	FrWqwyW.exe	115
PID 2420 wrote to memory of 4108	2420	FrWqwyW.exe	117
PID 2420 wrote to memory of 4108	2420	FrWqwyW.exe	117
PID 2420 wrote to memory of 3260	2420	FrWqwyW.exe	119
PID 2420 wrote to memory of 3260	2420	FrWqwyW.exe	119
PID 2420 wrote to memory of 2036	2420	FrWqwyW.exe	121
PID 2420 wrote to memory of 2036	2420	FrWqwyW.exe	121
PID 2420 wrote to memory of 4924	2420	FrWqwyW.exe	123
PID 2420 wrote to memory of 4924	2420	FrWqwyW.exe	123
PID 2420 wrote to memory of 5080	2420	FrWqwyW.exe	125
PID 2420 wrote to memory of 5080	2420	FrWqwyW.exe	125
PID 2420 wrote to memory of 756	2420	FrWqwyW.exe	127
PID 2420 wrote to memory of 756	2420	FrWqwyW.exe	127
PID 2420 wrote to memory of 4964	2420	FrWqwyW.exe	129
PID 2420 wrote to memory of 4964	2420	FrWqwyW.exe	129
PID 2420 wrote to memory of 3920	2420	FrWqwyW.exe	131
PID 2420 wrote to memory of 3920	2420	FrWqwyW.exe	131
PID 2420 wrote to memory of 1344	2420	FrWqwyW.exe	133
PID 2420 wrote to memory of 1344	2420	FrWqwyW.exe	133
PID 2420 wrote to memory of 1344	2420	FrWqwyW.exe	133
PID 2420 wrote to memory of 4984	2420	FrWqwyW.exe	134
PID 2420 wrote to memory of 4984	2420	FrWqwyW.exe	134
PID 2420 wrote to memory of 5008	2420	FrWqwyW.exe	135
PID 2420 wrote to memory of 5008	2420	FrWqwyW.exe	135
PID 4984 wrote to memory of 4808	4984	cmd.exe	138
PID 4984 wrote to memory of 4808	4984	cmd.exe	138
PID 1344 wrote to memory of 388	1344	tkkgm.exe	139
PID 1344 wrote to memory of 388	1344	tkkgm.exe	139
PID 1344 wrote to memory of 388	1344	tkkgm.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Wong_B.vbs"
1⤵
PID:2280

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
  C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe /C
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:720
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3428
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yyjmymqexs /tr "\"C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe\" /I yyjmymqexs" /SC ONCE /Z /ST 01:56 /ET 02:08
  2⤵
  - Creates scheduled task(s)
  PID:4624

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe /I yyjmymqexs
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:2228
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:4108
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:3260
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:5080
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:756
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci" /d "0"
  2⤵
  - Windows security bypass
  PID:3920
- C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4808
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /DELETE /F /TN yyjmymqexs
  2⤵
  PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FrWqwyW.exe

Path C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
Size 660KB
SHA256 f5d56d68b93516d18564a7862f2494e99827a0bd9071476e0585a2a345e7879a
MD5 048a451e99556b0f90576c2a976073d7
SHA1 1d3bc3472ec2313038f120020e3ce54db3db72f3
SHA512 eb2aff455619c4dda5ed02f1b46a36a065d26671b55a8c94c8d47cd50419288b3937ebc014c9a5fc3dc3bc8a7223e5bfa54b963575cda0606b2f611e4ad9f3d4
SSDEEP 12288:WxszODReayYRFT51o0iM66h7iHuNgtwMAJ+t+Nxdfu/CdzwDnrst:g1DR1yqY0iMl7iHuNgOA4x2CdzCrst
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkkgm.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Gcjuotlci\tkkgm.dat
Size 63B
SHA256 2366cd750bd9325185f2cd36f097a70994fd587c6b16f427404d0b1920d7da65
MD5 8f7f6dd1b10670b989a51f3969d35117
SHA1 baec12d325d97fe685f3a79ee5bcbacbe4373f1a
SHA512 5b9e4246dfaedcdda4354c4e3fcade69411acc8629de7a967a679ecff48d817eca53f94308e30b40063592a3f09d73c4402da97f11e020985cde1799a01cb377
MD5 SHA1 SHA512

Submit Download

memory/388-55-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/720-29-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/1344-56-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/1484-23-0x00000000021B0000-0x0000000002241000-memory.dmp

Download

memory/1484-35-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/2420-50-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/2420-43-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/3124-24-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/3124-4-0x0000000002030000-0x00000000020C1000-memory.dmp

Download

memory/3124-5-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/3428-34-0x0000000000A10000-0x0000000000AA1000-memory.dmp

Download

memory/3428-33-0x0000000002860000-0x00000000028A0000-memory.dmp

Download

memory/3428-39-0x0000000002860000-0x00000000028A0000-memory.dmp

Download

memory/3428-37-0x0000000002860000-0x00000000028A0000-memory.dmp

Download

memory/3428-36-0x0000000002860000-0x00000000028A0000-memory.dmp

Download

memory/3428-32-0x0000000000A10000-0x0000000000AA1000-memory.dmp

Download

memory/3428-30-0x0000000000A10000-0x0000000000AA1000-memory.dmp

Download

memory/4312-9-0x0000000002290000-0x0000000002321000-memory.dmp

Download

memory/4312-13-0x0000000000400000-0x00000000004A7000-memory.dmp

Download