Analysis Overview
SHA256
223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e
Threat Level: Known bad
The file 223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e was found to be: Known bad.
Malicious Activity Summary
Detects DLL dropped by Raspberry Robin.
Laplas Clipper
RedLine
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Downloads MZ/PE file
Loads dropped DLL
Themida packer
Checks BIOS information in registry
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks whether UAC is enabled
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
GoLang User-Agent
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-07-30 23:19
Signatures
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-07-30 23:19
Reported
2023-07-30 23:24
Platform
win7-20230712-en
Max time kernel
276s
Max time network
287s
Command Line
Signatures
Detects DLL dropped by Raspberry Robin.
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Laplas Clipper
RedLine
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\Notepod.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe | N/A |
Downloads MZ/PE file
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\Notepod.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\Notepod.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Notepod.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Notepod.exe | N/A |
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" | C:\Users\Admin\AppData\Local\Temp\Notepod.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\Notepod.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Notepod.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2636 set thread context of 2980 | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
GoLang User-Agent
| Description | Indicator | Process | Target |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe
"C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\Notepod.exe
"C:\Users\Admin\AppData\Local\Temp\Notepod.exe"
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rc3007.tuktuk.ug | udp |
| NL | 85.209.3.9:11290 | rc3007.tuktuk.ug | tcp |
| NL | 45.66.230.149:80 | 45.66.230.149 | tcp |
| US | 8.8.8.8:53 | lpls.tuktuk.ug | udp |
| NL | 45.66.230.149:80 | lpls.tuktuk.ug | tcp |
Files
memory/2636-54-0x0000000000F60000-0x0000000001604000-memory.dmp
memory/2636-55-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-56-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-58-0x0000000076B60000-0x0000000076BA7000-memory.dmp
memory/2636-60-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-62-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-63-0x00000000775C0000-0x00000000775C2000-memory.dmp
memory/2636-64-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-65-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-66-0x0000000000F60000-0x0000000001604000-memory.dmp
memory/2636-68-0x0000000076B60000-0x0000000076BA7000-memory.dmp
memory/2636-69-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-70-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-71-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-72-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-73-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-74-0x00000000002D0000-0x00000000002EC000-memory.dmp
memory/2636-75-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-76-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-78-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-80-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-82-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-84-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-86-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-88-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-90-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-92-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-94-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-96-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2636-98-0x00000000002D0000-0x00000000002E5000-memory.dmp
memory/2980-99-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2980-100-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2980-101-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2980-102-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2980-103-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2980-104-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2980-106-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2980-108-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2636-110-0x0000000075030000-0x0000000075140000-memory.dmp
memory/2636-111-0x0000000076B60000-0x0000000076BA7000-memory.dmp
memory/2980-112-0x00000000003B0000-0x00000000003B6000-memory.dmp
memory/2636-113-0x0000000000F60000-0x0000000001604000-memory.dmp
memory/2980-114-0x0000000074610000-0x0000000074CFE000-memory.dmp
memory/2980-115-0x00000000004D0000-0x0000000000510000-memory.dmp
memory/2980-116-0x0000000074610000-0x0000000074CFE000-memory.dmp
memory/2980-117-0x00000000004D0000-0x0000000000510000-memory.dmp
\Users\Admin\AppData\Local\Temp\Notepod.exe
| MD5 | b30e29bccabab032c27910210d9ccf76 |
| SHA1 | caa3927738b66c3ecc553943eabedcbbfbe4c0da |
| SHA256 | b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2 |
| SHA512 | ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8 |
C:\Users\Admin\AppData\Local\Temp\Notepod.exe
| MD5 | b30e29bccabab032c27910210d9ccf76 |
| SHA1 | caa3927738b66c3ecc553943eabedcbbfbe4c0da |
| SHA256 | b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2 |
| SHA512 | ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8 |
memory/2980-123-0x000000000BF60000-0x000000000C7FB000-memory.dmp
memory/988-124-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/2980-125-0x0000000074610000-0x0000000074CFE000-memory.dmp
memory/988-126-0x00000000773D0000-0x0000000077579000-memory.dmp
memory/988-127-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-128-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-129-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-130-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-131-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-132-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-133-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-134-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-135-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-136-0x0000000001010000-0x00000000018AB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Notepod.exe
| MD5 | b30e29bccabab032c27910210d9ccf76 |
| SHA1 | caa3927738b66c3ecc553943eabedcbbfbe4c0da |
| SHA256 | b6e2f26fea81267dc7b39b4f919083c8c8be5ff233a5c3acca6e1339d5bb21e2 |
| SHA512 | ce8348d0547de624b1bf19804c87b1e0379d29c5fe585d0ac602f51dd1bab90649654b87ebd236eef593829757d182ae16facbd5c2710bfecc87837c63a495a8 |
memory/988-138-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-139-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-140-0x00000000773D0000-0x0000000077579000-memory.dmp
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
| MD5 | 0a56cc6f5a6214db21e504f27c26cb9c |
| SHA1 | cfd262b4dca501fc6936d2f10d3529e1d0b10e09 |
| SHA256 | eae46b93dbc67f48f588834dfa4547557644debffd676dccacc91de83cf494f7 |
| SHA512 | 1ce1baa1b25e8bce4956182a2b0ad68235ce6de474e61f565b17fe6c71315873e0f2e5e0a37be6ce187fc096948c93ee16d8c1dd08e24aab1ccf0bb9bd99ef0d |
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
| MD5 | 0a56cc6f5a6214db21e504f27c26cb9c |
| SHA1 | cfd262b4dca501fc6936d2f10d3529e1d0b10e09 |
| SHA256 | eae46b93dbc67f48f588834dfa4547557644debffd676dccacc91de83cf494f7 |
| SHA512 | 1ce1baa1b25e8bce4956182a2b0ad68235ce6de474e61f565b17fe6c71315873e0f2e5e0a37be6ce187fc096948c93ee16d8c1dd08e24aab1ccf0bb9bd99ef0d |
memory/988-144-0x0000000028850000-0x00000000290EB000-memory.dmp
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
| MD5 | 0a56cc6f5a6214db21e504f27c26cb9c |
| SHA1 | cfd262b4dca501fc6936d2f10d3529e1d0b10e09 |
| SHA256 | eae46b93dbc67f48f588834dfa4547557644debffd676dccacc91de83cf494f7 |
| SHA512 | 1ce1baa1b25e8bce4956182a2b0ad68235ce6de474e61f565b17fe6c71315873e0f2e5e0a37be6ce187fc096948c93ee16d8c1dd08e24aab1ccf0bb9bd99ef0d |
memory/1036-147-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/988-146-0x0000000001010000-0x00000000018AB000-memory.dmp
memory/988-148-0x00000000773D0000-0x0000000077579000-memory.dmp
memory/1036-149-0x00000000773D0000-0x0000000077579000-memory.dmp
memory/1036-150-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-151-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-152-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-153-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-154-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-155-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-156-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-157-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-158-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-159-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-160-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-161-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-162-0x00000000773D0000-0x0000000077579000-memory.dmp
memory/1036-163-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-164-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-165-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-166-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-167-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-168-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-171-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-172-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-173-0x0000000000D50000-0x00000000015EB000-memory.dmp
memory/1036-174-0x0000000000D50000-0x00000000015EB000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-07-30 23:19
Reported
2023-07-30 23:24
Platform
win10-20230703-en
Max time kernel
124s
Max time network
256s
Command Line
Signatures
Detects DLL dropped by Raspberry Robin.
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
RedLine
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 972 set thread context of 4124 | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe
"C:\Users\Admin\AppData\Local\Temp\223f8d67c784e3f6cc85c721dd718af53510f6884dbc1ea4dd328cc26da03f5e.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rc3007.tuktuk.ug | udp |
| NL | 85.209.3.9:11290 | rc3007.tuktuk.ug | tcp |
| US | 8.8.8.8:53 | 9.3.209.85.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.8.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.57.101.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.173.189.20.in-addr.arpa | udp |
Files
memory/972-122-0x0000000000980000-0x0000000001024000-memory.dmp
memory/972-123-0x00000000755A0000-0x0000000075762000-memory.dmp
memory/972-124-0x00000000755A0000-0x0000000075762000-memory.dmp
memory/972-125-0x00000000755A0000-0x0000000075762000-memory.dmp
memory/972-126-0x0000000075770000-0x0000000075840000-memory.dmp
memory/972-130-0x0000000000980000-0x0000000001024000-memory.dmp
memory/972-131-0x0000000005980000-0x0000000005A1C000-memory.dmp
memory/972-132-0x0000000000980000-0x0000000001024000-memory.dmp
memory/972-133-0x00000000755A0000-0x0000000075762000-memory.dmp
memory/972-135-0x0000000075770000-0x0000000075840000-memory.dmp
memory/972-136-0x00000000058F0000-0x000000000590C000-memory.dmp
memory/972-137-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-138-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-140-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-142-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-144-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-146-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-148-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-150-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-152-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-154-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-156-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-158-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/972-160-0x00000000058F0000-0x0000000005905000-memory.dmp
memory/4124-161-0x0000000000400000-0x0000000000430000-memory.dmp
memory/972-167-0x0000000000980000-0x0000000001024000-memory.dmp
memory/972-168-0x00000000755A0000-0x0000000075762000-memory.dmp
memory/4124-170-0x0000000073220000-0x000000007390E000-memory.dmp
memory/4124-169-0x00000000068F0000-0x00000000068F6000-memory.dmp
memory/972-171-0x0000000075770000-0x0000000075840000-memory.dmp
memory/4124-172-0x0000000009610000-0x0000000009C16000-memory.dmp
memory/4124-173-0x0000000009110000-0x000000000921A000-memory.dmp
memory/4124-174-0x0000000008FF0000-0x0000000009000000-memory.dmp
memory/4124-175-0x0000000008F50000-0x0000000008F62000-memory.dmp
memory/4124-176-0x0000000008FB0000-0x0000000008FEE000-memory.dmp
memory/4124-177-0x0000000009000000-0x000000000904B000-memory.dmp
memory/4124-182-0x00000000092E0000-0x0000000009356000-memory.dmp
memory/4124-183-0x0000000009400000-0x0000000009492000-memory.dmp
memory/4124-184-0x000000000A630000-0x000000000AB2E000-memory.dmp
memory/4124-187-0x00000000094A0000-0x0000000009506000-memory.dmp
memory/4124-194-0x0000000073220000-0x000000007390E000-memory.dmp
memory/4124-197-0x000000000A400000-0x000000000A5C2000-memory.dmp
memory/4124-198-0x000000000C380000-0x000000000C8AC000-memory.dmp
memory/4124-313-0x0000000008FF0000-0x0000000009000000-memory.dmp
memory/4124-580-0x0000000073220000-0x000000007390E000-memory.dmp