Malware Analysis Report

2024-09-23 03:18

Sample ID 240707-bll9nazaqm
Target 9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe
SHA256 9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc
Tags
persistence asyncrat stormkitty default rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc

Threat Level: Known bad

The file 9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe was found to be: Known bad.

Malicious Activity Summary

persistence asyncrat stormkitty default rat spyware stealer

StormKitty payload

StormKitty

AsyncRat

Async RAT payload

Drops file in Drivers directory

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks computer location settings

Drops startup file

Executes dropped EXE

Drops desktop.ini file(s)

Looks up external IP address via web service

Looks up geolocation information via web service

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Delays execution with timeout.exe

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-07 01:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-07 01:14

Reported

2024-07-07 01:16

Platform

win7-20240508-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\system32\relog.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psvhost.exe.lnk C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system32\relog.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\WpnUserService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe" C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2224 set thread context of 2164 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe C:\Windows\system32\relog.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe

"C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe"

C:\Windows\system32\relog.exe

C:\Windows\system32\relog.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 auth.xn--conbase-sfb.xyz udp
US 8.8.8.8:53 exchanger.ink udp
US 8.8.8.8:53 auth.xn--conbase-sfb.xyz udp
US 8.8.8.8:53 exchanger.ink udp
US 8.8.8.8:53 auth.xn--conbase-sfb.xyz udp
US 8.8.8.8:53 exchanger.ink udp

Files

C:\Windows\System32\drivers\etc\hosts

MD5 ee9d791fd900430e4d594e5bde5c096a
SHA1 25dd0ac5926d1d02bf4c9fe60d5aff6b602c9b7d
SHA256 74c6900b084deaf2ac76ee2113cfe73509e751c588707395fa2731e9bc154ccd
SHA512 cd1c18139594002e96c7094ff731812d9afb45fb34735731fb65eaecbd7918c2379fa52b8eea551ac9c51589827619f898a9a0ac95ee1ad8c0e94b589403efeb

memory/2164-7-0x000007FFFFFD3000-0x000007FFFFFD4000-memory.dmp

\Users\Admin\AppData\Local\Temp\TH8B3F.tmp

MD5 52d46be6bb8dc6d8fd09925e84a76994
SHA1 2639980aa48b17ee9fdc169872703453c8e73deb
SHA256 03b152b94fc40a782d7e12d58ad1d6b00b1029757811f841f64fdbd4831e694b
SHA512 3ea9efd5cbd44185ee2709a2ca787e8981fd5de1c757890f1636c9c79624203abdb341b9e0075a51733286aec963043ec2a2ac6651ec9bba043cdf81b32fd0c4

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-07 01:14

Reported

2024-07-07 01:16

Platform

win10v2004-20240704-en

Max time kernel

37s

Max time network

148s

Command Line

C:\Windows\Explorer.EXE

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\system32\relog.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service_Adobe.exe.lnk C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service_Microsoft.exe.lnk C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service_Mozilla.exe.lnk C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service_Sun.exe.lnk C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\psvhost.exe.lnk C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Service_Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Service_Microsoft.exe" C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Service_Mozilla = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Service_Mozilla.exe" C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Service_Sun = "C:\\Users\\Admin\\AppData\\Roaming\\Sun\\Service_Sun.exe" C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WpnUserService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe" C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ACCC Tools = "C:\\ProgramData\\KMSAuto\\accc.exe" C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Service_Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Service_Adobe.exe" C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe N/A
File created C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe N/A
File created C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe N/A
File created C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe N/A
File created C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe N/A
File created C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3700 set thread context of 2904 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe C:\Windows\system32\relog.exe

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\ProgramData\KMSAuto\accc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A
N/A N/A C:\Windows\system32\relog.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\relog.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3700 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe C:\Windows\system32\relog.exe
PID 3700 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe C:\Windows\system32\relog.exe
PID 3700 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe C:\Windows\system32\relog.exe
PID 2904 wrote to memory of 3460 N/A C:\Windows\system32\relog.exe C:\Windows\Explorer.EXE
PID 2904 wrote to memory of 3460 N/A C:\Windows\system32\relog.exe C:\Windows\Explorer.EXE
PID 3460 wrote to memory of 772 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe
PID 3460 wrote to memory of 772 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe
PID 3460 wrote to memory of 556 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe
PID 3460 wrote to memory of 556 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe
PID 3460 wrote to memory of 556 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe
PID 772 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe C:\Windows\system32\schtasks.exe
PID 772 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe C:\Windows\system32\schtasks.exe
PID 772 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe C:\ProgramData\KMSAuto\accc.exe
PID 772 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe C:\ProgramData\KMSAuto\accc.exe
PID 772 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe C:\Windows\system32\cmd.exe
PID 772 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe C:\Windows\system32\cmd.exe
PID 3260 wrote to memory of 3536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3260 wrote to memory of 3536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe

"C:\Users\Admin\AppData\Local\Temp\9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc.exe"

C:\Windows\system32\relog.exe

C:\Windows\system32\relog.exe

C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe

"C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe"

C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe

"C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe"

C:\Windows\system32\schtasks.exe

"schtasks.exe" /create /tn ACCC Tools /tr "C:\ProgramData\KMSAuto\accc.exe" /st 01:19 /du 23:59 /sc daily /ri 1 /f

C:\ProgramData\KMSAuto\accc.exe

"C:\ProgramData\KMSAuto\accc.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD0AE.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 7

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 auth.xn--conbase-sfb.xyz udp
US 172.67.133.32:443 auth.xn--conbase-sfb.xyz tcp
US 8.8.8.8:53 x2.c.lencr.org udp
GB 95.100.245.168:80 x2.c.lencr.org tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 32.133.67.172.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 auth.xn--conbase-sfb.xyz udp
US 104.21.13.213:80 auth.xn--conbase-sfb.xyz tcp
US 8.8.8.8:53 auth.xn--conbase-sfb.xyz udp
US 8.8.8.8:53 213.13.21.104.in-addr.arpa udp
US 104.21.13.213:80 auth.xn--conbase-sfb.xyz tcp
US 104.21.13.213:80 auth.xn--conbase-sfb.xyz tcp
US 104.21.13.213:80 auth.xn--conbase-sfb.xyz tcp
US 8.8.8.8:53 www.igenius.org udp
US 192.3.140.185:80 www.igenius.org tcp
US 192.3.140.185:80 www.igenius.org tcp
US 8.8.8.8:53 185.140.3.192.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.184.241:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 172.67.196.114:443 api.mylnikov.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 241.184.16.104.in-addr.arpa udp
US 8.8.8.8:53 114.196.67.172.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 104.21.13.213:80 auth.xn--conbase-sfb.xyz tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 104.21.13.213:80 auth.xn--conbase-sfb.xyz tcp

Files

C:\Users\Admin\AppData\Roaming\Adobe\Service_Adobe.exe

MD5 839b3efd5782b6fc122855665f3aa202
SHA1 067c1b809106a1b9ad1641a9c745d4b83ece1196
SHA256 91ebcd79cfcbfedda3c557c5bb1ee5da9f4d13d518491d22a0e92f2caab7bec0
SHA512 1abfa3908386a7e579837548978ce0bac26cc2d9f3194ef652d2ce9810bbed84130d9cddabdc100256a118e362a33d0933df3511745f75de06c8dfa2bb88ffe4

C:\Users\Admin\AppData\Local\Temp\TH8B38.tmp

MD5 52d46be6bb8dc6d8fd09925e84a76994
SHA1 2639980aa48b17ee9fdc169872703453c8e73deb
SHA256 03b152b94fc40a782d7e12d58ad1d6b00b1029757811f841f64fdbd4831e694b
SHA512 3ea9efd5cbd44185ee2709a2ca787e8981fd5de1c757890f1636c9c79624203abdb341b9e0075a51733286aec963043ec2a2ac6651ec9bba043cdf81b32fd0c4

C:\Windows\System32\drivers\etc\hosts

MD5 1530b50aac226cd50815c69326517e51
SHA1 e97855298b61d8a5b6cf2450a990d5cbc40c6aa4
SHA256 1c1eab02470f70f1067cc91ae1506955f2cd92eac3afac8eb3592cc718c2cab3
SHA512 c66ee426b16c2ab3439617774b914dd279351b4c3dc14e16d6e7cdb11cd0cf0d3346df87a315f5a0de885522e3bfdcc2513e73f2d01cf0e5f13f77f7facdb432

memory/3460-88-0x0000000000FA0000-0x0000000000FB6000-memory.dmp

memory/3460-86-0x0000000003740000-0x0000000003783000-memory.dmp

memory/3460-90-0x0000000008CA0000-0x0000000008CF1000-memory.dmp

memory/3460-93-0x0000000008CA0000-0x0000000008CF1000-memory.dmp

memory/3460-92-0x0000000003790000-0x00000000037AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C60F.tmp.Installer.exe

MD5 bed8cdced2d57be2bd750f0f59991ecd
SHA1 4e2a885b9387fcf040b7eb79892de2f9fe55bca4
SHA256 5f628663f71e3baa55f10e6021597f7860bef868284eb50b8958169dcbbff4fd
SHA512 b85990a778c2462d57c3b314270bd1f397749450e75508e1012a14f21661358b98021efb791f694d9eb05f49b0776ea3ff4c803f842f858db5669968c477433f

memory/3460-102-0x00007FFE5AB60000-0x00007FFE5AB61000-memory.dmp

memory/772-106-0x00007FFE3E2B3000-0x00007FFE3E2B5000-memory.dmp

memory/772-107-0x0000000000B10000-0x0000000000BB0000-memory.dmp

memory/772-108-0x00007FFE3E2B0000-0x00007FFE3ED71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C8CF.tmp.Server.exe

MD5 68fad5f5f8de1c290df5d3754b4af358
SHA1 0028395243f38a03b13726915144b9848e8da39a
SHA256 dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e
SHA512 ce44611d5c47fdcb979c715352f5050c816d4e5a814b102836856ede279f774e4709ca48fb95639ca66476ca547176370da7afc5185af066832732da2c80ee01

memory/556-120-0x0000000000780000-0x00000000007B2000-memory.dmp

memory/772-135-0x00007FFE3E2B0000-0x00007FFE3ED71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD0AE.tmp.bat

MD5 9830379dea3f0b4a93d307aab418eef1
SHA1 e7c6f855034624f7f7ac0f0f143469dee5f8fddb
SHA256 329f902df928c8174ab502c453646a69b7234f201a9d4fa98702aade627cce85
SHA512 a92b40838fdd3b52b362a294cf35cbc353787adcfcf626ceb77cb72716b18ab119d01c707b82db42496b5c0047a1f7cf0706fb63a484e399bc1e5ee95b4da02a

memory/556-137-0x00000000051B0000-0x0000000005216000-memory.dmp

C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\Browsers\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

memory/3460-234-0x0000000008CA0000-0x0000000008CF1000-memory.dmp

C:\Users\Admin\AppData\Local\695e425853551939cd8cba58b49444e5\Admin@WQMJVIBL_en-US\System\Process.txt

MD5 270ebf5d36f61592790054a5f11086cf
SHA1 1633b3be679b9cb1aa419998a168020a30cc3824
SHA256 f52d68c32abf1b32cff2c2ff2b17888e7ee4cca180fd60fda1b8531383ddb696
SHA512 8454b413a90d46f847756ffdeab2e4b790b997db74a60db31544b6bc7b52517451c282fa3eecb776c3a23efb14f5c74f87ebc70d47c399122da5cd7a34d9306e

memory/556-284-0x0000000005AD0000-0x0000000005B62000-memory.dmp

memory/556-285-0x0000000006120000-0x00000000066C4000-memory.dmp

memory/556-289-0x0000000005690000-0x000000000569A000-memory.dmp

C:\Users\Admin\AppData\Local\9ebea84d79f00fad1a57e081ba507849\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/556-295-0x00000000060C0000-0x00000000060D2000-memory.dmp