Malware Analysis Report

2025-01-19 07:23

Sample ID 231219-mb1vvabbc7
Target 027cb66f8eda3f2819ac4b8c67c4551a
SHA256 15a9251e8d697fd00288f1c495030de0933224204c294459bd2656793c16d6b1
Tags
upx tinba banker persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

15a9251e8d697fd00288f1c495030de0933224204c294459bd2656793c16d6b1

Threat Level: Known bad

The file 027cb66f8eda3f2819ac4b8c67c4551a was found to be: Known bad.

Malicious Activity Summary

upx tinba banker persistence trojan

Tinba / TinyBanker

UPX packed file

Adds Run key to start application

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Checks processor information in registry

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-19 10:18

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-19 10:18

Reported

2023-12-19 10:55

Platform

win7-20231215-en

Max time kernel

149s

Max time network

148s

Command Line

C:\Windows\Explorer.EXE

Signatures

Tinba / TinyBanker

trojan banker tinba

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\9AA882D6 = "C:\\Users\\Admin\\AppData\\Roaming\\9AA882D6\\bin.exe" C:\Windows\SysWOW64\winver.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\winver.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Users\Admin\AppData\Local\Temp\027cb66f8eda3f2819ac4b8c67c4551a.exe

"C:\Users\Admin\AppData\Local\Temp\027cb66f8eda3f2819ac4b8c67c4551a.exe"

C:\Windows\SysWOW64\winver.exe

winver

Network

Country Destination Domain Proto
US 8.8.8.8:53 spaines.pw udp
US 216.218.185.162:80 spaines.pw tcp

Files

memory/1928-0-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1928-1-0x0000000000020000-0x0000000000021000-memory.dmp

memory/1892-5-0x0000000000120000-0x0000000000126000-memory.dmp

memory/1144-4-0x0000000002E30000-0x0000000002E36000-memory.dmp

memory/1928-3-0x0000000001D60000-0x0000000002760000-memory.dmp

memory/1144-2-0x0000000002E30000-0x0000000002E36000-memory.dmp

memory/1892-11-0x0000000000C50000-0x0000000000C66000-memory.dmp

memory/1144-10-0x00000000776C1000-0x00000000776C2000-memory.dmp

memory/1892-9-0x0000000077870000-0x0000000077871000-memory.dmp

memory/1892-7-0x000000007786F000-0x0000000077870000-memory.dmp

memory/1144-6-0x0000000002E30000-0x0000000002E36000-memory.dmp

memory/1892-8-0x000000007786F000-0x0000000077871000-memory.dmp

memory/1928-12-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1928-13-0x0000000001D60000-0x0000000002760000-memory.dmp

memory/1892-15-0x0000000000120000-0x0000000000126000-memory.dmp

memory/1892-16-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1088-22-0x00000000003A0000-0x00000000003A6000-memory.dmp

memory/1144-28-0x0000000002DE0000-0x0000000002DE6000-memory.dmp

memory/1088-27-0x00000000003A0000-0x00000000003A6000-memory.dmp

memory/1056-26-0x00000000776C1000-0x00000000776C2000-memory.dmp

memory/1056-25-0x0000000000130000-0x0000000000136000-memory.dmp

memory/1144-24-0x0000000002DE0000-0x0000000002DE6000-memory.dmp

memory/1892-32-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/1892-33-0x0000000000120000-0x0000000000126000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-19 10:18

Reported

2023-12-19 10:56

Platform

win10v2004-20231215-en

Max time kernel

160s

Max time network

169s

Command Line

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

Signatures

Tinba / TinyBanker

trojan banker tinba

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0F321B94 = "C:\\Users\\Admin\\AppData\\Roaming\\0F321B94\\bin.exe" C:\Windows\SysWOW64\winver.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\WerFault.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\WerFault.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\WerFault.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A
N/A N/A C:\Windows\SysWOW64\winver.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\backgroundTaskHost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\backgroundTaskHost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\backgroundTaskHost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\winver.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1512 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\027cb66f8eda3f2819ac4b8c67c4551a.exe C:\Windows\SysWOW64\winver.exe
PID 1512 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\027cb66f8eda3f2819ac4b8c67c4551a.exe C:\Windows\SysWOW64\winver.exe
PID 1512 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\027cb66f8eda3f2819ac4b8c67c4551a.exe C:\Windows\SysWOW64\winver.exe
PID 1512 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\027cb66f8eda3f2819ac4b8c67c4551a.exe C:\Windows\SysWOW64\winver.exe
PID 3312 wrote to memory of 3464 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\Explorer.EXE
PID 3312 wrote to memory of 2476 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\sihost.exe
PID 3312 wrote to memory of 2500 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\svchost.exe
PID 3312 wrote to memory of 2844 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\taskhostw.exe
PID 3312 wrote to memory of 3464 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\Explorer.EXE
PID 3312 wrote to memory of 3656 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\svchost.exe
PID 3312 wrote to memory of 3864 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\DllHost.exe
PID 3312 wrote to memory of 4004 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3312 wrote to memory of 4080 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\System32\RuntimeBroker.exe
PID 3312 wrote to memory of 2740 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3312 wrote to memory of 3976 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\System32\RuntimeBroker.exe
PID 3312 wrote to memory of 4452 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\System32\RuntimeBroker.exe
PID 3312 wrote to memory of 316 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3312 wrote to memory of 3544 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3312 wrote to memory of 4360 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3312 wrote to memory of 1044 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\System32\RuntimeBroker.exe
PID 3312 wrote to memory of 4952 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\System32\RuntimeBroker.exe
PID 3312 wrote to memory of 772 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\WerFault.exe
PID 3312 wrote to memory of 1036 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3312 wrote to memory of 4508 N/A C:\Windows\SysWOW64\winver.exe C:\Windows\System32\RuntimeBroker.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\027cb66f8eda3f2819ac4b8c67c4551a.exe

"C:\Users\Admin\AppData\Local\Temp\027cb66f8eda3f2819ac4b8c67c4551a.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\winver.exe

winver

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3864 -s 920

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 spaines.pw udp
US 216.218.185.162:80 spaines.pw tcp
US 8.8.8.8:53 162.185.218.216.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/1512-0-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1512-1-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1512-2-0x0000000000440000-0x0000000000441000-memory.dmp

memory/1512-3-0x0000000002220000-0x0000000002C20000-memory.dmp

memory/3312-5-0x00000000005D0000-0x00000000005D6000-memory.dmp

memory/3312-4-0x00000000005B0000-0x00000000005C2000-memory.dmp

memory/3464-7-0x0000000000FB0000-0x0000000000FB6000-memory.dmp

memory/3312-8-0x0000000077A82000-0x0000000077A83000-memory.dmp

memory/3464-9-0x00007FFB87CAD000-0x00007FFB87CAE000-memory.dmp

memory/1512-11-0x0000000002220000-0x0000000002C20000-memory.dmp

memory/3312-13-0x00000000005D0000-0x00000000005D6000-memory.dmp

memory/2500-15-0x00000000005E0000-0x00000000005E6000-memory.dmp

memory/2844-16-0x0000000000820000-0x0000000000826000-memory.dmp

memory/3464-18-0x0000000000FC0000-0x0000000000FC6000-memory.dmp

memory/2500-19-0x00000000005E0000-0x00000000005E6000-memory.dmp

memory/2476-17-0x0000000000470000-0x0000000000476000-memory.dmp

memory/2844-23-0x0000000000820000-0x0000000000826000-memory.dmp

memory/3656-24-0x0000000000070000-0x0000000000076000-memory.dmp

memory/4004-25-0x0000000000C00000-0x0000000000C06000-memory.dmp

memory/3864-22-0x00000000006E0000-0x00000000006E6000-memory.dmp

memory/3464-21-0x0000000000FC0000-0x0000000000FC6000-memory.dmp

memory/3656-20-0x0000000000070000-0x0000000000076000-memory.dmp

memory/4004-27-0x0000000000C00000-0x0000000000C06000-memory.dmp

memory/4080-26-0x0000000000E20000-0x0000000000E26000-memory.dmp

memory/3312-28-0x00000000005D0000-0x00000000005D6000-memory.dmp

memory/4080-29-0x0000000000E20000-0x0000000000E26000-memory.dmp

memory/3976-31-0x00000000001C0000-0x00000000001C6000-memory.dmp

memory/4452-32-0x0000000000830000-0x0000000000836000-memory.dmp

memory/316-33-0x00000000004B0000-0x00000000004B6000-memory.dmp

memory/3976-34-0x00000000001C0000-0x00000000001C6000-memory.dmp

memory/4452-35-0x0000000000830000-0x0000000000836000-memory.dmp

memory/316-36-0x00000000004B0000-0x00000000004B6000-memory.dmp

memory/3544-37-0x0000000000FC0000-0x0000000000FC6000-memory.dmp

memory/4360-38-0x0000000000480000-0x0000000000486000-memory.dmp

memory/1044-39-0x0000000000FF0000-0x0000000000FF6000-memory.dmp

memory/1044-41-0x0000000000FF0000-0x0000000000FF6000-memory.dmp

memory/4952-40-0x0000000000390000-0x0000000000396000-memory.dmp

memory/4952-42-0x0000000000390000-0x0000000000396000-memory.dmp

memory/772-43-0x0000000000FD0000-0x0000000000FD6000-memory.dmp

memory/3656-44-0x0000000000070000-0x0000000000076000-memory.dmp

memory/772-45-0x0000000000FD0000-0x0000000000FD6000-memory.dmp

memory/772-59-0x00007FFB87E20000-0x00007FFB87E21000-memory.dmp

memory/772-64-0x00007FFB87E30000-0x00007FFB87E31000-memory.dmp

memory/1036-71-0x0000000000B00000-0x0000000000B06000-memory.dmp

memory/1036-72-0x0000000000B00000-0x0000000000B06000-memory.dmp

memory/1036-73-0x00007FFB87CAD000-0x00007FFB87CAE000-memory.dmp

memory/1036-74-0x00007FFB87E40000-0x00007FFB87E41000-memory.dmp

memory/4004-75-0x00007FFB87E20000-0x00007FFB87E21000-memory.dmp

memory/3464-76-0x00007FFB87E40000-0x00007FFB87E41000-memory.dmp

memory/4508-81-0x0000000000C00000-0x0000000000C06000-memory.dmp

memory/4508-82-0x0000000000C00000-0x0000000000C06000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\310091\c366f2fe3b4d44d98f19003abb5493b4_1

MD5 9f9a5e8fea8b42267c31c73b4c880794
SHA1 ae881c6f26dbc45a991f81cdb3e570fe3f2d2183
SHA256 76c5a40293ba2fc405de01054d8f34226ca09e53ae871e23648456b9e8d63cf9
SHA512 46c27e3040b4aebd0acc2556960f3cfa6dd7fb56fde18aa1e366b83023adc196496d9772a7abdc0ab15e1569398a50788a2f1df3079073feff3a9e8e5ab11d7c

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\a87b97da226f4d979abd6868eab9cc30_1

MD5 01c08c4a0ee30f855bc29670f5bfa420
SHA1 0736440f840298136141efeba03bf445eb3a71e1
SHA256 af48d1a6ae230063a95e2cfee0f8c8fb751ffe3410ce2e7e308931e961fd6b97
SHA512 08f0552177832e678e011c24065741bebe8ad7e17c62871ed81618ee12b156b53d3ab88b227e0f6d62791d930f376a062bab0ac0b09071d28c80e9c87939fab5

memory/4508-89-0x00007FFB87E40000-0x00007FFB87E41000-memory.dmp

memory/1036-90-0x00007FFB87E30000-0x00007FFB87E31000-memory.dmp

memory/4508-91-0x00007FFB87E30000-0x00007FFB87E31000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat

MD5 0663e111b226e976aad35711d8934153
SHA1 1d08aea08b5745d1c148f54e82e7f5373457aec2
SHA256 4cfef5d13eadda69bd5cb71fbc38af64f0d08be7fff5229be4214726a50754c9
SHA512 e2ac8da3d3884fdc76e76bc8692bd9100ea95cbc91d513920a5d6e9d080c48610e8b9c996bac74a48a7896f0e53770353f160f6dc1161e0624979cb28c83b517

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat

MD5 cbb9dba0debc184bffbde912125c9226
SHA1 ed94d85381f0b96619bdf3a8bc30d48e1d4446bc
SHA256 9c113acd30dc6cc529b905b4d8fa4fcf762ea9d3967a51ccebce83f3585dcb63
SHA512 23971452a5c5406ebe449f0e41ed13e195b1757c7d5028e737380fc2bcfce787941c29d2644d529516422171ffb7ca54ddd1f468efc431d44e6e9c4d274f6db3

memory/1036-107-0x0000000000B00000-0x0000000000B06000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat

MD5 fb86d3b7f8acae7689d250415f0c7c85
SHA1 61ce9fd4a0ac2df963bdfcbe6504cf0d9fea0f65
SHA256 10102f845968aa2eb8b3d8bbeaa3488fe5282f0b387e3ea1693af037ba7af523
SHA512 42cfcbe7ba5b6bd1c0e0971d7ad2484b5f015381924dcdbd8851576d098d6c1ead8122587d2285da7d95c9a088e10483e612c9e166a568bac39b781b710b5114

memory/4080-118-0x00007FFB87E20000-0x00007FFB87E21000-memory.dmp

memory/4080-119-0x00007FFB87E40000-0x00007FFB87E41000-memory.dmp

memory/4080-120-0x00007FFB87E30000-0x00007FFB87E31000-memory.dmp