Malware Analysis Report

2025-01-02 02:54

Sample ID 220222-qj1ftshcc3
Target 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc
SHA256 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc
Tags
sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc

Threat Level: Known bad

The file 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat trojan

Sakula

Executes dropped EXE

Loads dropped DLL

Deletes itself

Adds Run key to start application

Drops file in Windows directory

Modifies registry key

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-22 13:18

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-22 13:18

Reported

2022-02-22 13:22

Platform

win7-en-20211208

Max time kernel

262s

Max time network

269s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1084 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1860 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1636 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1636 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1636 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1636 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 660 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 660 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 660 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 660 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe

"C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/1084-54-0x0000000075341000-0x0000000075343000-memory.dmp

memory/1084-55-0x0000000000401000-0x0000000000404000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 70dde17cb3e843bfc80701fb0c9f29c3
SHA1 0b61c2e7b72dece5d70ed46d202921ffcfe2ea81
SHA256 8f741ff9f605e8a049e85280729c961827d9ee2fe0777901b676333c20f878f5
SHA512 8e42fbc6af85ecfdd8d38704b4121a6490211456c080382ec453801bcccedbcc7fec5df409d3c7abc1fcda230b8a7aa84f15af668a61ccf0bea6634450a200a1

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 70dde17cb3e843bfc80701fb0c9f29c3
SHA1 0b61c2e7b72dece5d70ed46d202921ffcfe2ea81
SHA256 8f741ff9f605e8a049e85280729c961827d9ee2fe0777901b676333c20f878f5
SHA512 8e42fbc6af85ecfdd8d38704b4121a6490211456c080382ec453801bcccedbcc7fec5df409d3c7abc1fcda230b8a7aa84f15af668a61ccf0bea6634450a200a1

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 70dde17cb3e843bfc80701fb0c9f29c3
SHA1 0b61c2e7b72dece5d70ed46d202921ffcfe2ea81
SHA256 8f741ff9f605e8a049e85280729c961827d9ee2fe0777901b676333c20f878f5
SHA512 8e42fbc6af85ecfdd8d38704b4121a6490211456c080382ec453801bcccedbcc7fec5df409d3c7abc1fcda230b8a7aa84f15af668a61ccf0bea6634450a200a1

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 70dde17cb3e843bfc80701fb0c9f29c3
SHA1 0b61c2e7b72dece5d70ed46d202921ffcfe2ea81
SHA256 8f741ff9f605e8a049e85280729c961827d9ee2fe0777901b676333c20f878f5
SHA512 8e42fbc6af85ecfdd8d38704b4121a6490211456c080382ec453801bcccedbcc7fec5df409d3c7abc1fcda230b8a7aa84f15af668a61ccf0bea6634450a200a1

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-22 13:18

Reported

2022-02-22 13:23

Platform

win10-en-20211208

Max time kernel

281s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2032 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe C:\Windows\SysWOW64\cmd.exe
PID 2776 wrote to memory of 3148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 3148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 3148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2784 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2784 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2764 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2764 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2764 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe

"C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/2032-115-0x0000000000401000-0x0000000000404000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 8dfc468a34e6b97561d36dfdecfa5c11
SHA1 f8e7281c62dfa7d6ef5eae4198b300d0082a1360
SHA256 323a9886e675abd2d85c55038d8228a6a4871c7a691fb334acae2b976817cad2
SHA512 5c9fe0eeaaabfcc67e8d9078ef86a06dafc3600423cdd9d0f7fe6481c97b6ac695147d6500ea68631959d34ea01c4fad6539db195877e9075bcb0e5dff3bd4a3

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 8dfc468a34e6b97561d36dfdecfa5c11
SHA1 f8e7281c62dfa7d6ef5eae4198b300d0082a1360
SHA256 323a9886e675abd2d85c55038d8228a6a4871c7a691fb334acae2b976817cad2
SHA512 5c9fe0eeaaabfcc67e8d9078ef86a06dafc3600423cdd9d0f7fe6481c97b6ac695147d6500ea68631959d34ea01c4fad6539db195877e9075bcb0e5dff3bd4a3

Analysis: behavioral3

Detonation Overview

Submitted

2022-02-22 13:18

Reported

2022-02-22 13:22

Platform

win10v2004-en-20220113

Max time kernel

248s

Max time network

232s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe

"C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.msn.com udp
US 131.253.33.203:443 api.msn.com tcp
NL 67.26.111.254:80 tcp
NL 67.26.111.254:80 tcp
NL 67.26.111.254:80 tcp
US 8.8.8.8:53 crl4.digicert.com udp
US 93.184.220.29:80 crl4.digicert.com tcp
US 8.8.8.8:53 14.110.152.52.in-addr.arpa udp

Files

memory/4792-131-0x0000023C5C820000-0x0000023C5C830000-memory.dmp

memory/4792-130-0x0000023C5C190000-0x0000023C5C1A0000-memory.dmp

memory/4792-132-0x0000023C5EF10000-0x0000023C5EF14000-memory.dmp