stormkitty | 456c0f28c52578f27a0859bde7cd01543bbacb94295d195b440a097a000f1ced

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe
Size 1.5MB
Sample240818-cfne7szanf
SHA256 9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba
MD5 ff83471ce09ebbe0da07d3001644b23c
SHA1 672aa37f23b421e4afba46218735425f7acc29c2
SHA512 179c724558065de4b7ea11dd75588df51a3fce737db3ebc77c8fdc0b3a432f6f1fdcc5acd2e2706ab0f088c35a3310c9e638de92ce0a644322eae46729aea259
SSDEEP 24576:nK7tMGUfQtpOdk3xWBq0qWH6JubmMTzfZwLDC4pZylqUAc2:JQ7AkiqQaJjMHWvlpOqUt2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stormkitty discovery stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/5044-33-0x0000000000700000-0x0000000000798000-memory.dmp	family_stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4744 created 3420	4744	Optimum.pif	56

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe

Executes dropped EXE 2 IoCs

pid	Process
4744	Optimum.pif
5044	RegAsm.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1624	tasklist.exe
448	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\GamblingCedar	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe
File opened for modification	C:\Windows\AnchorAnnotated	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe
File opened for modification	C:\Windows\CheckingReliable	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe
File opened for modification	C:\Windows\ConferencesInto	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Optimum.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe
5044	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	tasklist.exe
Token: SeDebugPrivilege	448	tasklist.exe
Token: SeDebugPrivilege	5044	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4744	Optimum.pif
4744	Optimum.pif
4744	Optimum.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5044	RegAsm.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 3884	3608	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe	84
PID 3608 wrote to memory of 3884	3608	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe	84
PID 3608 wrote to memory of 3884	3608	9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe	84
PID 3884 wrote to memory of 1624	3884	cmd.exe	89
PID 3884 wrote to memory of 1624	3884	cmd.exe	89
PID 3884 wrote to memory of 1624	3884	cmd.exe	89
PID 3884 wrote to memory of 908	3884	cmd.exe	90
PID 3884 wrote to memory of 908	3884	cmd.exe	90
PID 3884 wrote to memory of 908	3884	cmd.exe	90
PID 3884 wrote to memory of 448	3884	cmd.exe	94
PID 3884 wrote to memory of 448	3884	cmd.exe	94
PID 3884 wrote to memory of 448	3884	cmd.exe	94
PID 3884 wrote to memory of 3620	3884	cmd.exe	95
PID 3884 wrote to memory of 3620	3884	cmd.exe	95
PID 3884 wrote to memory of 3620	3884	cmd.exe	95
PID 3884 wrote to memory of 2776	3884	cmd.exe	96
PID 3884 wrote to memory of 2776	3884	cmd.exe	96
PID 3884 wrote to memory of 2776	3884	cmd.exe	96
PID 3884 wrote to memory of 4180	3884	cmd.exe	97
PID 3884 wrote to memory of 4180	3884	cmd.exe	97
PID 3884 wrote to memory of 4180	3884	cmd.exe	97
PID 3884 wrote to memory of 2500	3884	cmd.exe	98
PID 3884 wrote to memory of 2500	3884	cmd.exe	98
PID 3884 wrote to memory of 2500	3884	cmd.exe	98
PID 3884 wrote to memory of 4744	3884	cmd.exe	99
PID 3884 wrote to memory of 4744	3884	cmd.exe	99
PID 3884 wrote to memory of 4744	3884	cmd.exe	99
PID 3884 wrote to memory of 4604	3884	cmd.exe	100
PID 3884 wrote to memory of 4604	3884	cmd.exe	100
PID 3884 wrote to memory of 4604	3884	cmd.exe	100
PID 4744 wrote to memory of 5044	4744	Optimum.pif	105
PID 4744 wrote to memory of 5044	4744	Optimum.pif	105
PID 4744 wrote to memory of 5044	4744	Optimum.pif	105
PID 4744 wrote to memory of 5044	4744	Optimum.pif	105
PID 4744 wrote to memory of 5044	4744	Optimum.pif	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe
  "C:\Users\Admin\AppData\Local\Temp\9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Surrey Surrey.cmd && Surrey.cmd && exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1624
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:908
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:448
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 719580
      4⤵
      System Location Discovery: System Language Discovery
      PID:2776
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "copehebrewinquireinnocent" Corpus
      4⤵
      System Location Discovery: System Language Discovery
      PID:4180
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Utilize + ..\Verzeichnis + ..\Built + ..\Vessels + ..\Cradle + ..\Jaguar + ..\Comics + ..\Flux + ..\Liberal f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
      Optimum.pif f
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4744
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:4604
- C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Optimum.pif

Path C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
Size 63KB
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
SSDEEP 768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\719580\f
Size 619KB
SHA256 3d4000a64c1b7be8fcefe59e8f39f1ae12ef1fcd9d30a39158f83b26ee189831
MD5 43ca848d3a9ee13623e355d9ee71b515
SHA1 944f72b5cc721b44bf50c0013b4b10151972074d
SHA512 e52336e652a69b34c41aa9283d8e2e8e795c5734507b23050f48aa25be4423eafcc416f38bf23463de0602c20a24f0fd75629ec23214119b4c4a98025be8513f
SSDEEP 12288:2kbMOM98N4oUy8x0Gm/UIxgVZ/QJOFqUAkd/GJDIUpTk6qX31iEO9jO+:2CMj8468CGjZ/A4qUAU/mPTz+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Built

Path C:\Users\Admin\AppData\Local\Temp\Built
Size 58KB
SHA256 7b857693641ff1ff59e69422b09299a5580d20677acd530c27c7fbc9e3ee3b92
MD5 0a91386341f9d1a371bc735576b276a4
SHA1 a02598ef42cef1443cc94a8310a6c02df07119d4
SHA512 b492508575c01689c982a8eb57fac2b5759e4c843c92f99d231b63c25ab4c82fa7fece9d4e9c2cc436a3232b4ed7947baecf2a06aafbf1a3cf243395af71e96b
SSDEEP 1536:SlMy2a7r92w5YFyD9LIAPyzpA8Eo0DpCJMxEqEiEcGwuI:Say2a7rUyl98APr8rZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Comics

Path C:\Users\Admin\AppData\Local\Temp\Comics
Size 66KB
SHA256 2caa4849a4353ca50dfdbc860412e95b783fdcc7e60d8756c9b4bdf2915e1923
MD5 4a3aab84dbfdaf25ae909ac736489f4b
SHA1 76663cb1186f29fed429863013600c9d69355d36
SHA512 1c2b0ffa8783bb9e9082eae4214547d8ced58121e717b57884a56042a7ef70c55e702d7f018dea72ca95aa40170c6f24ccec7d56fa3b160237969b5c0473bea5
SSDEEP 1536:K9jLfz0mMpeOIe2XOzsPX0lqrDXrm1xfu5PgbC6SktQ:CjLfMpJDI7PwiD7m7fu5N6Skm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Corpus

Path C:\Users\Admin\AppData\Local\Temp\Corpus
Size 236B
SHA256 849892bc358956ee263db6cbddd4a9cca0e1564d6caefe44e2e998d559e610a0
MD5 148febc94e0f8036a074350ef338b007
SHA1 1be93210e5348f9409fe4162599dfaad797a2ade
SHA512 72b83e8cb35bf6fe295f1cb84197f3ffb4944e19b9ece9f6664ed2bc4aca40c9c912debf260e891c80feebb4c84935da4c2996b9a100ce94cde177928f31fa92
MD5 SHA1 SHA512

Submit Download

Cradle

Path C:\Users\Admin\AppData\Local\Temp\Cradle
Size 78KB
SHA256 3ab028b25bd6bd3ba48a92c4198dd8ff07fe71b4b41c785469d79da422f2fe46
MD5 8c59dae352a159e484b0de9603dabc11
SHA1 34992e582081635abf736ec18f1492ae40ca4925
SHA512 cf041cc9470ac479702c19714d875868a5168940a8d56715a98ae3d52f0363ffab160566d7c364b1bd9e8cb263b7e2b60e6719dbac7b6ad12e5f6a87e4f57d8e
SSDEEP 1536:/CQMFM+YmTFkug7BEtRlMbHNEzvScLI7KiwXSNrNCsj9OxFFKhcBvvd:7M+nIkugVaLIupSNxCs5OTvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Flux

Path C:\Users\Admin\AppData\Local\Temp\Flux
Size 92KB
SHA256 f4e881ea8495c993e2f008e9b5fc082bc2cea97812fe944dda293f3b02fb60b0
MD5 523fea93bbf3f0b9ddd4d1a432b624c9
SHA1 578ccd6f97455881ca61fddf068695ab0daa8918
SHA512 633474c0d83e92171d09ab5849b83a9bcd613f630ec54ee44ad42ac8102d25c987f9e3ec71ea6c2d3542bcc9919ded6e37c3754a8f074aeea9704f16770692f4
SSDEEP 1536:kSoh89hjRXMMWf/AJ8CjiEayqehBAJI/LWpelRtItxJyrmIpKz725GCn4reiAF0I:kSLXXRWnA2EiENPAJIaMlRtI0pKEnpGI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Folding

Path C:\Users\Admin\AppData\Local\Temp\Folding
Size 872KB
SHA256 95d53427ef46fb44354a0253a611e342a30428101acaf83215f5b21432afbff1
MD5 67ff730b62d42030058393ab3f0dafd1
SHA1 79215f079836dd43b4f7b1e66739bd7dab9fb6a3
SHA512 6e7d6f12686b0b30c96eebe01546e4aee1adee39a7467409e8f41de9a37c65daa010ebcefa6c452d4849e7ba0bec9be55be1b38250420b40e2956c151478d973
SSDEEP 12288:ppVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:pT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jaguar

Path C:\Users\Admin\AppData\Local\Temp\Jaguar
Size 93KB
SHA256 49687025dce701973b47fb6caba71f1443471e64551f41967a6a3275ce1e93d5
MD5 fdadac1c5944e618315f608ad2f02714
SHA1 debe3ccc5a4abc326dbcb4a86ec8074671a3417f
SHA512 92d7da5ef3625157acb00752b74fcfb80c588bc3ddf8b7fda488f68d0a6cf332aade539ee92139a26c5dc3549c8a69471ca24fcb1568068d5293b8988bbbab58
SSDEEP 1536:wnfOV7NIaJwXdyi57FOeF06/wmQUqsyd5GAG4J+jzJaSm4U4YhwVPUTmz/L6BPWO:GGVrJSnROey6/wmQUMdUAG4J+jXtWwdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Liberal

Path C:\Users\Admin\AppData\Local\Temp\Liberal
Size 38KB
SHA256 aacfabd8f6dde87949cbafa8eab7536dc5377e726064445e62824d10584eaec5
MD5 524c0177830e8a3624062be7eddfa277
SHA1 0a830e50e9433d530094edf3577b7ec5c5d1c5f5
SHA512 79ed8be7d451a885befb7001c52a9f0db3977be8e16abd7db9f7742d520270a650ac77ed72e512a377d8f888bf05643f6bce3fea2d4dba8f37c7fff73a70d0cd
SSDEEP 768:6dPzmFnkp1On83v3yPxYN44IMDIgMdFSx4+0jtJBGxCU2lakk1:8zm2ORJ94IMjc20pJBOJ2kX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Surrey

Path C:\Users\Admin\AppData\Local\Temp\Surrey
Size 14KB
SHA256 66627eef98fb038f1d22f620bc8d85430a442d08313602eb02f0b158b5471812
MD5 721cde52d197da4629a6792103404e23
SHA1 1f5bac364c6b9546ba0501f41766bb25df98b32b
SHA512 63a6786227915bc450ea9ca4df4962126b4194a1fd5c68fe3c686da8175726d4efdda5e88aedea7b8e4e758816b9b31981fa79e37dbe51028650def5042ccac6
SSDEEP 384:kLum4LqK73AkbyuDIoidiLrPESD5fMqgzavJHNFz0Kr:YunzAkbyuDIxdTq2aJHNFz0W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utilize

Path C:\Users\Admin\AppData\Local\Temp\Utilize
Size 83KB
SHA256 96af995b201e5392293f2d7272b1c9a3f0eb671d62aeafffb4b0bbbfed0e3560
MD5 4bb39f0bce8a4f7b640ba76ecccaf87b
SHA1 c0c7feca88b0fc3fc1f20d1963ae25388a1f4c12
SHA512 ad2752281067584233cc19b3d0bbd0178dc3907af71c8dc3c37afe35f417afe1b1fc4d9ad2d99506d53100afde8ddb692e93669b8c9398782cb03dc22a04e1ef
SSDEEP 1536:50737Zu1pW4WFMX2sSG4D+0rHaW/ryzzNJ88sEHwDHpZ4Flql1oJZ/Clv1uUf8Ff:C7VIpmo54DvB2zzw8sEHwM3qgP/CjdfO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Verzeichnis

Path C:\Users\Admin\AppData\Local\Temp\Verzeichnis
Size 61KB
SHA256 41586643456496d40c3279839a1cb1528428c19deefb4c702bd58f1467a1a1d0
MD5 6a5ab833602af088d60d3d7f89b77229
SHA1 32f9fe7c6ba035993a627a78491651f02d0dfc97
SHA512 0598b2b38270a8d282ae2325330420b467be203047dffc2e85626fd78e78f81c5084487eebfbefbcb36115732a6670a9857655c18803388c02e37fbcf51aaa66
SSDEEP 1536:bE01NhpJ4umTQFQIXyiNYIXARex6bIpn5iptyTkXz:PXVM8QI3mIQRIxpn5iptyTkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vessels

Path C:\Users\Admin\AppData\Local\Temp\Vessels
Size 50KB
SHA256 c8c35545936faa3b0e00aa1b907952e97fffd9c1958045253863b4c2fad7f295
MD5 d64ef3bbcca2c221c0bcc85a7b6d5209
SHA1 5c3cf9d492c7021e19e103fa14ab3965fd1c6ba3
SHA512 2b6713646373b5b233295930a46fefbd499b607a94051c6294d3dce12f58b187c98f22f7f0b1243f22611a82c659b1d95f70a7858247b8f0853a1765d449e611
SSDEEP 768:DkYzVGAKcFp5NzYNo486frRLddT7NpJ8UtCVS/TQaKs8hu7cN3xCwe:Dk0GAKAtzYNouft7N5sPRXD4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5044-33-0x0000000000700000-0x0000000000798000-memory.dmp

Download

memory/5044-36-0x0000000005400000-0x00000000059A4000-memory.dmp

Download

memory/5044-37-0x0000000004D40000-0x0000000004DA6000-memory.dmp

Download

memory/5044-39-0x0000000005DD0000-0x0000000005E62000-memory.dmp

Download

memory/5044-40-0x0000000005F10000-0x0000000005FAC000-memory.dmp

Download

memory/5044-41-0x0000000005DB0000-0x0000000005DBA000-memory.dmp

Download