JMA malware

Main object- "JMA_Weather_Apps.exe"
	sha256	9d204eddaebd3d8624349b9492a3f3c8cc5a524e848419bb039d739b4d152292
	sha1	244eb50ecf7cad4be310a5b016bfc05a57ccd014
	md5	2bd380ac4ee04a429fbc15065add09e8
Dropped executable file
	sha256	C:\ProgramData\mozglue.dll	3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\freebl3[1].dll	a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
	sha256	C:\ProgramData\msvcp140.dll	334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\nss3[1].dll	e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
	sha256	C:\ProgramData\vcruntime140.dll	c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
	sha256	C:\ProgramData\softokn3.dll	43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
	sha256	C:\ProgramData\FLP1RO3WU1.exe	cdc13684f41107a2ff3c367f50d64af2c71f2f004775d0307deb5ee6980a5965
	sha256	C:\Users\admin\AppData\Local\Temp\F3E9.tmp	d35574d2cc42b4edbf217a86639864422fbe02443250a36eb2cd11b22f165c39
DNS requests
	domain	acrelop.com
	domain	everfree-inc.jp
	domain	ip-api.com
Connections
	ip	45.34.187.110
	ip	208.95.112.1
	ip	157.112.176.43
HTTP/HTTPS requests
	url	http://ip-api.com/line/
	url	http://everfree-inc.jp/css/jma.exe