Malware Analysis Report

2024-11-30 16:01

Sample ID 220619-x2bczsccb5
Target 34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4
SHA256 34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4
Tags
imminent spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4

Threat Level: Known bad

The file 34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4 was found to be: Known bad.

Malicious Activity Summary

imminent spyware trojan

Imminent RAT

Drops startup file

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Windows directory

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-06-19 19:20

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-19 19:20

Reported

2022-06-19 19:44

Platform

win7-20220414-en

Max time kernel

191s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe"

Signatures

Imminent RAT

trojan spyware imminent

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcQMAw.url C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 964 set thread context of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 964 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 964 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 964 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 964 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2004 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2004 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2004 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2004 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 964 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe

"C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f3jbiw1y\f3jbiw1y.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES951F.tmp" "c:\Users\Admin\AppData\Local\Temp\f3jbiw1y\CSCBEF9B7841F654C6E9C7759B3FBFF2A2B.TMP"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 zynovahk.duckdns.org udp

Files

memory/964-54-0x0000000001120000-0x00000000011FC000-memory.dmp

memory/2004-55-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\f3jbiw1y\f3jbiw1y.cmdline

MD5 5e2b454c6f97873ec3bce00ab9a450d5
SHA1 1631467a4faf1c0057d98fad2a056bc27ae9091f
SHA256 5584155d42c553f61d666761a74501c9fe3c55162676f5a4a1d64d679dee8319
SHA512 2d94cfc92afd29197b5e56ef625f90f140d7b57e5c411ae154a853b07492c2af29a37930dd03c957897f1887d7404312c564de31b6b9010e369d9716f77363f5

\??\c:\Users\Admin\AppData\Local\Temp\f3jbiw1y\f3jbiw1y.0.cs

MD5 096b1fa2af5a25c5b40610fe88219eb6
SHA1 fdc4272a990a72444bbb381af8bab487968f49b0
SHA256 a3cca5c4decede9d932aa43a21462c42fb3983af12aa6cf3c253fe47e44018bd
SHA512 ae7204895b5ead2b96b0fe9fb67bc25adf7ca3c421d9a5c9ae2fb3276078b6f4110e9fac919416e96c037fff8143916a3c7f1fc981b8e4584e5a6794f0e92793

memory/2036-58-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\f3jbiw1y\CSCBEF9B7841F654C6E9C7759B3FBFF2A2B.TMP

MD5 f6a5cff5bfb08db67bf3655fc91effd0
SHA1 a451bf8f937f7392f0a53998d7020308d049b13a
SHA256 b71ade6d9a772c33de64b7fc24ba4277cb865c7a022d6ef45da733c309fb268f
SHA512 e23fa8b5cb4dda7d38ff51cde63338783c89b184544de6d3730ac9d29a3c781d4540acdf8898684f9a6eff579f0e5870912a7a253f7ddeda7c7041fff649c1d6

C:\Users\Admin\AppData\Local\Temp\RES951F.tmp

MD5 7e7e4c5d7d7d527896d9802536c465b4
SHA1 378534883b5323269cb80d6372c4330a0aedd615
SHA256 6757a861fa0b57455fbd561e7a9bbc9ea07f6ec9522c9d084388470e0e597dbb
SHA512 0f4aa85dd68e67cba2e2c207048bca5051fc74480a64ceb0c225a9e6c6b156669a4cae7d3e00388b7b4d21510e4656ad5233906e4ce08405d2603080f812fdc6

C:\Users\Admin\AppData\Local\Temp\f3jbiw1y\f3jbiw1y.pdb

MD5 6921bb0f97f211dfcf7e88e12c576caf
SHA1 bf5fd529bc899703d70c60d29179a2d80f24cc86
SHA256 d0cc58443c13ce5922f80c835662aae1097552d91630f5ee149fa123f3d9534d
SHA512 d90943e9fcf4fce04a0a15db81665071ea1b78bc1851181e15ffe69d71e497654bfc44bb49f10e79d11b990fb9032f8922f8aab906be730d6c0cb6b8dd90666d

C:\Users\Admin\AppData\Local\Temp\f3jbiw1y\f3jbiw1y.dll

MD5 a575ea6aab41e342f71b43ce945335d7
SHA1 8a93b803fdc7406d4b22a6f37bcd4186a79027e9
SHA256 603509c4f9bd4df3aca4e1853eca4b2196e7b48019a371e1de44b6843d7931ea
SHA512 f963f882f43b9b209441fba62a2b42dc541fbc5b9444b464469be11eb6873473429560657196932b946ed181789d1344fcfacfcb17242e96c4c84a8cb10ff297

memory/964-63-0x0000000000220000-0x000000000022A000-memory.dmp

memory/964-64-0x00000000010A0000-0x0000000001100000-memory.dmp

memory/964-65-0x00000000002B0000-0x00000000002BC000-memory.dmp

memory/964-66-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

memory/964-67-0x00000000048D0000-0x0000000004926000-memory.dmp

memory/744-68-0x0000000000400000-0x0000000000456000-memory.dmp

memory/744-69-0x0000000000400000-0x0000000000456000-memory.dmp

memory/744-71-0x0000000000400000-0x0000000000456000-memory.dmp

memory/744-72-0x0000000000400000-0x0000000000456000-memory.dmp

memory/744-73-0x0000000000400000-0x0000000000456000-memory.dmp

memory/744-74-0x0000000000451E5E-mapping.dmp

memory/744-78-0x0000000000400000-0x0000000000456000-memory.dmp

memory/744-76-0x0000000000400000-0x0000000000456000-memory.dmp

memory/744-80-0x00000000749F0000-0x0000000074F9B000-memory.dmp

memory/744-81-0x00000000749F0000-0x0000000074F9B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-19 19:20

Reported

2022-06-19 19:43

Platform

win10v2004-20220414-en

Max time kernel

151s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe"

Signatures

Imminent RAT

trojan spyware imminent

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcQMAw.url C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4776 set thread context of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4776 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4776 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4776 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 548 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 548 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 548 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4776 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4776 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4776 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4776 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4776 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4776 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4776 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4776 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe

"C:\Users\Admin\AppData\Local\Temp\34fac25089c3b96f743705ffdd7ed3ef5213915c4fdaefa8a0cb5c984a3525c4.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\spgn5f4b\spgn5f4b.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA434.tmp" "c:\Users\Admin\AppData\Local\Temp\spgn5f4b\CSC6F2F74062EBB4F3FBE3F71C910F57258.TMP"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 204.79.197.200:443 tcp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 52.109.12.19:443 tcp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.253.135.241:80 tcp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 20.189.173.12:443 tcp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
NL 178.79.208.1:80 tcp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp
US 8.8.8.8:53 zynovahk.duckdns.org udp

Files

memory/4776-130-0x0000000000A20000-0x0000000000AFC000-memory.dmp

memory/548-131-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\spgn5f4b\spgn5f4b.cmdline

MD5 01e83b0312f782c52a66eec38a50a127
SHA1 a26295ebb10f5a3a41d82976478c3bc0879f1280
SHA256 b5d9d35be734f6ddd790a523bd08c5729fc61620b9e79b5e43a16c69e067d592
SHA512 350b7dacd4aec21bcd14298de86ec33c5a4c3274793803620c4265f381a2243c57f78ad888d71106d1a8eb1cf196d5e29982da598cc15325d1da555446fbe0ae

\??\c:\Users\Admin\AppData\Local\Temp\spgn5f4b\spgn5f4b.0.cs

MD5 096b1fa2af5a25c5b40610fe88219eb6
SHA1 fdc4272a990a72444bbb381af8bab487968f49b0
SHA256 a3cca5c4decede9d932aa43a21462c42fb3983af12aa6cf3c253fe47e44018bd
SHA512 ae7204895b5ead2b96b0fe9fb67bc25adf7ca3c421d9a5c9ae2fb3276078b6f4110e9fac919416e96c037fff8143916a3c7f1fc981b8e4584e5a6794f0e92793

memory/1396-134-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\spgn5f4b\CSC6F2F74062EBB4F3FBE3F71C910F57258.TMP

MD5 3ba9ada869b5bff7815562664b9b07f8
SHA1 e3057aae822c0aaa46a4fe4ea8b5715d89c78583
SHA256 cdb742248fd92dd16aeec37dd8e782d3937529d92c87ee2f9003c9bdf8c799ba
SHA512 a4b98cf1d69d94bad5148287b268cea0f27e9818779d6feb1b5b0451a48ab6be576d1586413e656218bf9c2f4eff02031e548971b5d63135aa2e0d3764b52d66

C:\Users\Admin\AppData\Local\Temp\RESA434.tmp

MD5 d8273a84acf462f246ff2bdc7f16eb8c
SHA1 c1e9904eb91b8bf1ea6a10aef9fdedcb4a820f6b
SHA256 462febfca228b9ed95b650145360673dd0f7e563fe38f99af258204b3a8f5a28
SHA512 2f6775fe3d45104513ffe08166983a0705f4d18a8c56eb84488bff6ce74da6d5857c43c77f604fda2d3f7eab6d63991ed0e79ba9a11872fcb5acbdd668b9ac92

C:\Users\Admin\AppData\Local\Temp\spgn5f4b\spgn5f4b.dll

MD5 4d680061a9ea1bd7d9f67bd56f42689e
SHA1 9fd1ee8573d700ae71226f74ba1d4b23c5a1e736
SHA256 af7ea859c422be220c01ad15985c8399fe6785966e725ea0ee88d67f05145ae9
SHA512 eda9fdbd8dc9163479969826d70162aa4c62412c61b9d12a56dd04cdafa90b4d08c4a0e853163cd62815ad5806630646af014f3df49e12e35a82a1315e7af306

C:\Users\Admin\AppData\Local\Temp\spgn5f4b\spgn5f4b.pdb

MD5 da55e73b18601dfb02b191670d09773d
SHA1 255b7fe3fe32f16e9087fa8e79867ca19d953a71
SHA256 c194e1f23c191c5925e7b9992a084d230a20a174d73986535f25e3832a2b17c5
SHA512 6a26f6892ea2d30449900d0f923e84ea7876c4a9c39fbf57ce16944e2d76b950160dc1e384a93c578aca407f8b395f9e025c7dbda1aad1ffebde3a0f33a06037

memory/4776-139-0x0000000005470000-0x0000000005502000-memory.dmp

memory/4776-140-0x0000000005B40000-0x0000000005BDC000-memory.dmp

memory/1260-141-0x0000000000000000-mapping.dmp

memory/1260-142-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1260-143-0x0000000074600000-0x0000000074BB1000-memory.dmp

memory/1260-144-0x0000000074600000-0x0000000074BB1000-memory.dmp