Malware Analysis Report

2024-11-30 21:27

Sample ID 231228-j9avjacfe2
Target d27345deb16d58eabcbe121a3959a192
SHA256 a820a5705cc64befde194a18e24fcf7fe4df57cdd65c3e3b4eda5d3a4aaceb58
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a820a5705cc64befde194a18e24fcf7fe4df57cdd65c3e3b4eda5d3a4aaceb58

Threat Level: Known bad

The file d27345deb16d58eabcbe121a3959a192 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Dridex payload

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-28 08:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-28 08:21

Reported

2024-01-08 10:59

Platform

win7-20231215-en

Max time kernel

150s

Max time network

125s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d27345deb16d58eabcbe121a3959a192.dll

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\dW260h0Bu\msdt.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\kKysOf\dccw.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\me0\lpksetup.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lgpbj = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\tp\\dccw.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\dW260h0Bu\msdt.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\kKysOf\dccw.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\me0\lpksetup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1204 wrote to memory of 2624 N/A N/A C:\Windows\system32\msdt.exe
PID 1204 wrote to memory of 2624 N/A N/A C:\Windows\system32\msdt.exe
PID 1204 wrote to memory of 2624 N/A N/A C:\Windows\system32\msdt.exe
PID 1204 wrote to memory of 2112 N/A N/A C:\Users\Admin\AppData\Local\dW260h0Bu\msdt.exe
PID 1204 wrote to memory of 2112 N/A N/A C:\Users\Admin\AppData\Local\dW260h0Bu\msdt.exe
PID 1204 wrote to memory of 2112 N/A N/A C:\Users\Admin\AppData\Local\dW260h0Bu\msdt.exe
PID 1204 wrote to memory of 2936 N/A N/A C:\Windows\system32\dccw.exe
PID 1204 wrote to memory of 2936 N/A N/A C:\Windows\system32\dccw.exe
PID 1204 wrote to memory of 2936 N/A N/A C:\Windows\system32\dccw.exe
PID 1204 wrote to memory of 2880 N/A N/A C:\Users\Admin\AppData\Local\kKysOf\dccw.exe
PID 1204 wrote to memory of 2880 N/A N/A C:\Users\Admin\AppData\Local\kKysOf\dccw.exe
PID 1204 wrote to memory of 2880 N/A N/A C:\Users\Admin\AppData\Local\kKysOf\dccw.exe
PID 1204 wrote to memory of 2792 N/A N/A C:\Windows\system32\lpksetup.exe
PID 1204 wrote to memory of 2792 N/A N/A C:\Windows\system32\lpksetup.exe
PID 1204 wrote to memory of 2792 N/A N/A C:\Windows\system32\lpksetup.exe
PID 1204 wrote to memory of 1940 N/A N/A C:\Users\Admin\AppData\Local\me0\lpksetup.exe
PID 1204 wrote to memory of 1940 N/A N/A C:\Users\Admin\AppData\Local\me0\lpksetup.exe
PID 1204 wrote to memory of 1940 N/A N/A C:\Users\Admin\AppData\Local\me0\lpksetup.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d27345deb16d58eabcbe121a3959a192.dll

C:\Windows\system32\msdt.exe

C:\Windows\system32\msdt.exe

C:\Users\Admin\AppData\Local\dW260h0Bu\msdt.exe

C:\Users\Admin\AppData\Local\dW260h0Bu\msdt.exe

C:\Windows\system32\dccw.exe

C:\Windows\system32\dccw.exe

C:\Users\Admin\AppData\Local\kKysOf\dccw.exe

C:\Users\Admin\AppData\Local\kKysOf\dccw.exe

C:\Windows\system32\lpksetup.exe

C:\Windows\system32\lpksetup.exe

C:\Users\Admin\AppData\Local\me0\lpksetup.exe

C:\Users\Admin\AppData\Local\me0\lpksetup.exe

Network

N/A

Files

memory/2632-1-0x000007FEF6610000-0x000007FEF66EA000-memory.dmp

memory/2632-0-0x0000000000100000-0x0000000000107000-memory.dmp

memory/1204-3-0x0000000076DF6000-0x0000000076DF7000-memory.dmp

memory/1204-4-0x0000000002A50000-0x0000000002A51000-memory.dmp

memory/1204-6-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-7-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-8-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-10-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-9-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-11-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-15-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-18-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-17-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-20-0x00000000029B0000-0x00000000029B7000-memory.dmp

memory/1204-19-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-27-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-29-0x0000000077090000-0x0000000077092000-memory.dmp

memory/1204-28-0x0000000077060000-0x0000000077062000-memory.dmp

memory/1204-16-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-14-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-12-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-38-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-13-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1204-40-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/2632-41-0x000007FEF6610000-0x000007FEF66EA000-memory.dmp

\Users\Admin\AppData\Local\dW260h0Bu\msdt.exe

MD5 aecb7b09566b1f83f61d5a4b44ae9c7e
SHA1 3a4a2338c6b5ac833dc87497e04fe89c5481e289
SHA256 fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5
SHA512 6e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746

C:\Users\Admin\AppData\Local\dW260h0Bu\DUser.dll

MD5 a392d239846187022028cb36d9674a07
SHA1 7fab29d0af7684e478fa1c0d22e8356e5452e94d
SHA256 af79937c840233611904a97173fbd181de01935bf1ae3e8dd884e4f266e20636
SHA512 ba740a9700f11815c0be0efc22cd58621f4bd90f435dde0205370a1198b5427241b5804c0b581a173e1a36098897607d1cafc2183097c75d8e58eb2fbcd54199

memory/2112-55-0x0000000000170000-0x0000000000177000-memory.dmp

memory/2112-56-0x000007FEF6670000-0x000007FEF674B000-memory.dmp

memory/2112-60-0x000007FEF6670000-0x000007FEF674B000-memory.dmp

\Users\Admin\AppData\Local\kKysOf\dccw.exe

MD5 a46cee731351eb4146db8e8a63a5c520
SHA1 8ea441e4a77642e12987ac842b36034230edd731
SHA256 283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA512 3573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc

\Users\Admin\AppData\Local\kKysOf\mscms.dll

MD5 da0b12ee3323edfe192d24071153613b
SHA1 6d58247df6ca6c874d4475fba19f6860bdc098a2
SHA256 5f228a141c6acadd9e1ee77bff5821fc09695245c46b1c5dc3bd40d3e628805d
SHA512 9a498d36b00246aeb8aa1cfe8a232160f0510fc30eee54e8ac640fd6d51a788743b345d4bddeb6b6b4d16d6768ce6b7ef6370e110902ae34abdc2dc89597d535

memory/1204-72-0x0000000076DF6000-0x0000000076DF7000-memory.dmp

memory/2880-74-0x00000000000E0000-0x00000000000E7000-memory.dmp

memory/2880-73-0x000007FEF5F90000-0x000007FEF606B000-memory.dmp

memory/2880-77-0x000007FEF5F90000-0x000007FEF606B000-memory.dmp

\Users\Admin\AppData\Local\me0\lpksetup.exe

MD5 50d28f3f8b7c17056520c80a29efe17c
SHA1 1b1e62be0a0bdc9aec2e91842c35381297d8f01e
SHA256 71613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f
SHA512 92bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861

\Users\Admin\AppData\Local\me0\slc.dll

MD5 d95fe877a8a2833ab326b8df409e1ac2
SHA1 55928e71ffc338acac2749480ca5abf03693b4f2
SHA256 d247dea566edc09b8a51b9690fb203b166044069e6768f0253e326954be8799b
SHA512 cc55dae47d83ecf2cb05ee11c75c52b507809bb7b4c573f52c9001cd58f6b4696ec8c5286ba075b41e77104e427945441e2f90de151f250cc5aa0609c45b8669

memory/1940-95-0x000007FEF5F90000-0x000007FEF606B000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yiudzqwx.lnk

MD5 e66d25973ba35282c42bc33e4073f7e2
SHA1 10a0cf427927ea4ed1064f2f70d8fd236a1b38a0
SHA256 d3cdc01743379f7dd8ba211ff58edacbd8c6893acb93527c196079098881b24c
SHA512 213f9ffe6ca6f5d904ba5e96c787178a0b0bf31b1f294806098d6013fa494b06a062c2a8c8725a6b19055f5544b7aeff27a5b25688bababe984f0df61dfb2856

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-28 08:21

Reported

2024-01-08 10:59

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

156s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d27345deb16d58eabcbe121a3959a192.dll

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fidpgamyc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\WDBq7Rbblm\\ie4ushowIE.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\XW5nSPe6n\DevicePairingWizard.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\X9YdH4C\ie4ushowIE.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\zEBMZ3Z2\EhStorAuthn.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3380 wrote to memory of 812 N/A N/A C:\Windows\system32\DevicePairingWizard.exe
PID 3380 wrote to memory of 812 N/A N/A C:\Windows\system32\DevicePairingWizard.exe
PID 3380 wrote to memory of 4600 N/A N/A C:\Users\Admin\AppData\Local\XW5nSPe6n\DevicePairingWizard.exe
PID 3380 wrote to memory of 4600 N/A N/A C:\Users\Admin\AppData\Local\XW5nSPe6n\DevicePairingWizard.exe
PID 3380 wrote to memory of 1988 N/A N/A C:\Windows\system32\ie4ushowIE.exe
PID 3380 wrote to memory of 1988 N/A N/A C:\Windows\system32\ie4ushowIE.exe
PID 3380 wrote to memory of 3196 N/A N/A C:\Users\Admin\AppData\Local\X9YdH4C\ie4ushowIE.exe
PID 3380 wrote to memory of 3196 N/A N/A C:\Users\Admin\AppData\Local\X9YdH4C\ie4ushowIE.exe
PID 3380 wrote to memory of 392 N/A N/A C:\Windows\system32\EhStorAuthn.exe
PID 3380 wrote to memory of 392 N/A N/A C:\Windows\system32\EhStorAuthn.exe
PID 3380 wrote to memory of 1436 N/A N/A C:\Users\Admin\AppData\Local\zEBMZ3Z2\EhStorAuthn.exe
PID 3380 wrote to memory of 1436 N/A N/A C:\Users\Admin\AppData\Local\zEBMZ3Z2\EhStorAuthn.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d27345deb16d58eabcbe121a3959a192.dll

C:\Windows\system32\DevicePairingWizard.exe

C:\Windows\system32\DevicePairingWizard.exe

C:\Users\Admin\AppData\Local\XW5nSPe6n\DevicePairingWizard.exe

C:\Users\Admin\AppData\Local\XW5nSPe6n\DevicePairingWizard.exe

C:\Windows\system32\ie4ushowIE.exe

C:\Windows\system32\ie4ushowIE.exe

C:\Users\Admin\AppData\Local\X9YdH4C\ie4ushowIE.exe

C:\Users\Admin\AppData\Local\X9YdH4C\ie4ushowIE.exe

C:\Windows\system32\EhStorAuthn.exe

C:\Windows\system32\EhStorAuthn.exe

C:\Users\Admin\AppData\Local\zEBMZ3Z2\EhStorAuthn.exe

C:\Users\Admin\AppData\Local\zEBMZ3Z2\EhStorAuthn.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 148.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 144.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp

Files

memory/1332-0-0x00007FFC40C00000-0x00007FFC40CDA000-memory.dmp

memory/1332-2-0x0000000000F50000-0x0000000000F57000-memory.dmp

memory/3380-3-0x0000000002E80000-0x0000000002E81000-memory.dmp

memory/3380-4-0x00007FFC558AA000-0x00007FFC558AB000-memory.dmp

memory/3380-7-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-6-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-8-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-9-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-16-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-17-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-19-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-18-0x0000000002E40000-0x0000000002E47000-memory.dmp

memory/3380-15-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-14-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-13-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-12-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-11-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-20-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-10-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-27-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/3380-29-0x00007FFC55970000-0x00007FFC55980000-memory.dmp

memory/3380-28-0x00007FFC55980000-0x00007FFC55990000-memory.dmp

memory/3380-38-0x0000000140000000-0x00000001400DA000-memory.dmp

memory/1332-41-0x00007FFC40C00000-0x00007FFC40CDA000-memory.dmp

C:\Users\Admin\AppData\Local\XW5nSPe6n\DevicePairingWizard.exe

MD5 d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1 b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA256 2adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA512 1191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f

C:\Users\Admin\AppData\Local\XW5nSPe6n\MFC42u.dll

MD5 bd2b2e3de9a6271222041041e8780f0c
SHA1 f6faabdd82d54fdecdd9e7ccd0779088dcd1e754
SHA256 0b953b338a47d8a1b10699a6c9097fa9243a3d6dab130b402de13e0ee56e3a6b
SHA512 bebcd2f6590d6ca146efb90fd1a6c3e61bc23d3101b98c76fdcd4fcf28c3163d0732d4d98db0781b69a3d88c22a99687d5d6b9176e0e4a64334d9d11ddfceb40

memory/4600-51-0x00007FFC47840000-0x00007FFC47921000-memory.dmp

C:\Users\Admin\AppData\Local\X9YdH4C\ie4ushowIE.exe

MD5 9de952f476abab0cd62bfd81e20a3deb
SHA1 109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256 e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA512 3cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9

C:\Users\Admin\AppData\Local\X9YdH4C\VERSION.dll

MD5 eb20291be6c4ed5a51be1fef2068e758
SHA1 d9dae7d0eb7e64fc8a3b476e6a4d52271ba75dcd
SHA256 6bf38e7d3fa3d38b2ea904647bc37121eeb0dbd3cc76cf85ee0fb79651f11d33
SHA512 86750efab3b7cb9b4a959f6c85ce1370e11ffb9122279e1b8607c7f9df61fa66bdfad58a5dc793e2acc295ed8088d8acc39698b91b69988a683214ac2dbdf6d9

memory/3196-64-0x00007FFC47980000-0x00007FFC47A5B000-memory.dmp

memory/3196-65-0x000002D12E730000-0x000002D12E737000-memory.dmp

memory/3196-69-0x00007FFC47980000-0x00007FFC47A5B000-memory.dmp

C:\Users\Admin\AppData\Local\zEBMZ3Z2\EhStorAuthn.exe

MD5 d45618e58303edb4268a6cca5ec99ecc
SHA1 1f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256 d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA512 5d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd

C:\Users\Admin\AppData\Local\zEBMZ3Z2\UxTheme.dll

MD5 03d1ad68075bdaf69084a81848250306
SHA1 680c993247ec922c4da2da164315d48d968252e8
SHA256 0a6882de54a7b0d724f3d2502fc96d46939ffd11a56ea727b18860deb4ac618d
SHA512 da9f3a2547b6a80d3eed3f982a69af32c090d9ac5f5362da831d3362f151ddd128f23f0c83e9a32ad59150488af1387fb6be7290035b29dd834aea05a0eb1b91

memory/1436-80-0x00007FFC47850000-0x00007FFC4792B000-memory.dmp

memory/1436-81-0x00000280A2580000-0x00000280A2587000-memory.dmp

memory/1436-85-0x00007FFC47850000-0x00007FFC4792B000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Enpllr.lnk

MD5 1864a901af3e2e42308e93b1f359688b
SHA1 7e82bd4c0f276081f93c9de23990873579631b48
SHA256 29a50bafacc084ed362f5079c2775da940e773e620e5322f29dc033229687eb8
SHA512 9a43222961df9707d2a61b8cc2ccb85423525987b7786215c80a9c7d24c46a1dd3a9d0cd772a0811e38984aff47794621a365821cbda2f64c37592345bdfbc59