Malware Analysis Report

2024-11-30 21:46

Sample ID 231230-24kfwsbhh8
Target 1f757ecf4a083364ad33710c0020ba16
SHA256 d94814b7b97e9e0955a9c3e04b7eb9de7246902dd6a3f203806a9715b4e6436e
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d94814b7b97e9e0955a9c3e04b7eb9de7246902dd6a3f203806a9715b4e6436e

Threat Level: Known bad

The file 1f757ecf4a083364ad33710c0020ba16 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-30 23:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-30 23:08

Reported

2024-01-04 19:10

Platform

win7-20231215-en

Max time kernel

150s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f757ecf4a083364ad33710c0020ba16.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\AxaVD\VaultSysUi.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Srfjajs = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\UserData\\N3zq3kLP\\VAULTS~1.EXE" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\AxaVD\VaultSysUi.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1232 wrote to memory of 3068 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1232 wrote to memory of 3068 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1232 wrote to memory of 3068 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 1232 wrote to memory of 2640 N/A N/A C:\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe
PID 1232 wrote to memory of 2640 N/A N/A C:\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe
PID 1232 wrote to memory of 2640 N/A N/A C:\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe
PID 1232 wrote to memory of 2620 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1232 wrote to memory of 2620 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1232 wrote to memory of 2620 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1232 wrote to memory of 2568 N/A N/A C:\Users\Admin\AppData\Local\AxaVD\VaultSysUi.exe
PID 1232 wrote to memory of 2568 N/A N/A C:\Users\Admin\AppData\Local\AxaVD\VaultSysUi.exe
PID 1232 wrote to memory of 2568 N/A N/A C:\Users\Admin\AppData\Local\AxaVD\VaultSysUi.exe
PID 1232 wrote to memory of 1760 N/A N/A C:\Windows\system32\EhStorAuthn.exe
PID 1232 wrote to memory of 1760 N/A N/A C:\Windows\system32\EhStorAuthn.exe
PID 1232 wrote to memory of 1760 N/A N/A C:\Windows\system32\EhStorAuthn.exe
PID 1232 wrote to memory of 2984 N/A N/A C:\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe
PID 1232 wrote to memory of 2984 N/A N/A C:\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe
PID 1232 wrote to memory of 2984 N/A N/A C:\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f757ecf4a083364ad33710c0020ba16.dll,#1

C:\Windows\system32\Netplwiz.exe

C:\Windows\system32\Netplwiz.exe

C:\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe

C:\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe

C:\Windows\system32\VaultSysUi.exe

C:\Windows\system32\VaultSysUi.exe

C:\Users\Admin\AppData\Local\AxaVD\VaultSysUi.exe

C:\Users\Admin\AppData\Local\AxaVD\VaultSysUi.exe

C:\Windows\system32\EhStorAuthn.exe

C:\Windows\system32\EhStorAuthn.exe

C:\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe

C:\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe

Network

N/A

Files

memory/2500-0-0x0000000140000000-0x0000000140226000-memory.dmp

memory/2500-1-0x0000000000110000-0x0000000000117000-memory.dmp

memory/1232-4-0x00000000774D6000-0x00000000774D7000-memory.dmp

memory/1232-5-0x0000000002970000-0x0000000002971000-memory.dmp

memory/2500-7-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-11-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-13-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-14-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-15-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-17-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-21-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-25-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-26-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-28-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-29-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-31-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-32-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-33-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-35-0x0000000002950000-0x0000000002957000-memory.dmp

memory/1232-34-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-30-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-27-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-42-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-24-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-23-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-22-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-20-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-19-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-18-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-16-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-43-0x00000000775E1000-0x00000000775E2000-memory.dmp

memory/1232-44-0x0000000077740000-0x0000000077742000-memory.dmp

memory/1232-12-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-10-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-9-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-8-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-53-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1232-59-0x0000000140000000-0x0000000140226000-memory.dmp

\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe

MD5 e43ec3c800d4c0716613392e81fba1d9
SHA1 37de6a235e978ecf3bb0fc2c864016c5b0134348
SHA256 636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c
SHA512 176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08

\Users\Admin\AppData\Local\Dq0udWbY\NETPLWIZ.dll

MD5 b338895cf32620411aec0c40876c55f5
SHA1 995e88c5d5eb7dba176f52ee4c601684691c28c7
SHA256 6c11e6bbb454b99ae53d264c2eed40ab706926b731e2d7deff5bff460c4524a6
SHA512 5764e2d49a8453519b2f13a3f98748b2ce9f01bdd5c594de9b276cef8b324d7f9c6c508c621a10e4ff9244383e63c05420f44a3b0075fb5fbb6e2727266d91eb

C:\Users\Admin\AppData\Local\Dq0udWbY\NETPLWIZ.dll

MD5 5ffa31d1c73373397646cd2b7230f5ca
SHA1 18ec0ce979e9148cb022ab367f30c3e227a537e3
SHA256 e88a86b93d2217d77e0e0b48763df9461c7bb7957ddddd3c48eb5e1091a5b134
SHA512 b6607aede285165136849f12d4b6d2ca0d498af45dcd43b536796ac9ba62648357bbc02bb1bc69783a685a3f664766a8dd97bad2fae029649cc8c61ff47e6a30

memory/2640-72-0x0000000140000000-0x0000000140227000-memory.dmp

memory/2640-77-0x0000000140000000-0x0000000140227000-memory.dmp

memory/2640-71-0x0000000000170000-0x0000000000177000-memory.dmp

C:\Users\Admin\AppData\Local\Dq0udWbY\Netplwiz.exe

MD5 84b7c3a3d879e71ba46c8e7253a52f1c
SHA1 3afef63ddc6fcae6e6721babe28c456a835ed4a7
SHA256 66719221127e3d65db9cd0e6a062178bc1d5b486030c311c56d392f16c4a1184
SHA512 7236e1fe4ae151dcaed90cd744cf1971a1243ec16beeccda96b1ddefc130fc61c2a72c6e24fcd0f596b702175dd6773b866a7eee42d46129fc31b514bf128f74

memory/1232-82-0x00000000774D6000-0x00000000774D7000-memory.dmp

C:\Users\Admin\AppData\Local\AxaVD\VaultSysUi.exe

MD5 f40ef105d94350d36c799ee23f7fec0f
SHA1 ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256 eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512 f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1

\Users\Admin\AppData\Local\AxaVD\credui.dll

MD5 6adaeb349fa352aa4283306b11f7e992
SHA1 81bbd11548509897197b0801f10206b4abcd9ccd
SHA256 9c4dea8552abf4034978b9e8d45fd25f65464307f102815777c8c51029aacb5e
SHA512 7b7b369b45a5ad832fc8c6eae4a65971696f801d599e5796b173b65401b2e6cf0b2bece912676fa3f88d550971199decfe204481d1e47b406f179f2ead401a91

memory/2568-93-0x00000000000E0000-0x00000000000E7000-memory.dmp

C:\Users\Admin\AppData\Local\AxaVD\credui.dll

MD5 433355fced50ad2e0d6a4b064dfe1c2c
SHA1 48daa0dcd116a1bcf40fed33ebc9e6818e2e07fe
SHA256 03a99dac49a1119aff7f4711fb0212543df0da4f2c2bc4e66563fd6a397381f8
SHA512 b7be53bb3039074503bac5be97bd001f15387b51a533e4925b210697fdf14b21d42409cd5ce16224ee4330e07383498026462768b64beebf13502684ba07f8ed

memory/2568-99-0x0000000140000000-0x0000000140227000-memory.dmp

\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe

MD5 48a0d7f7359a00991e3f94f46c15e06e
SHA1 b25eb3adbb3f4822d6ec908d594171b186f9e28e
SHA256 c5d3f531681e8abc880d04ed5fcc8a3f424f63899d6bc0365a79d3a2429277c9
SHA512 4d2e84284ca3ae41d79d04b3c49eb416ef898c24000ccc8864837106f845ab6a1db944457f7d54cc3de92bd8302e93e2303e3fe91715910214f3f613c03fa204

\Users\Admin\AppData\Local\9wz7ixG\WTSAPI32.dll

MD5 10e5519df3fe5c0c1d8422f0e956f0ac
SHA1 5fbbca444e0ee6d5289908a33a5b935004008edc
SHA256 91ae4d72c6914658726b8beee582255888f83a59e3d5471bca6a7319f43c52f6
SHA512 e1dc84c6ca92714546e0363ebf384615c4e7cad40eb4431c6e7e3c27f5ba48736a5a783a54974aae9032172f1b0daebebbcdbaa94669fa816312b2ebdf565eb9

C:\Users\Admin\AppData\Local\9wz7ixG\WTSAPI32.dll

MD5 b685ef79fd0247881a7a3868aba7ba10
SHA1 c67aeceb20fbd2cfd062aa1a11dc551078dcbba6
SHA256 885716232f99c223c234a1cc488a4ce73c11b6fb4fc7c8b63d674a3f7c869f1f
SHA512 a9a22cd996215cf712d3bf147a3a6019da30586fdd8295b45f3a69937b225265ab673fd899fd7ee68b4db6dd2e4b94e78b1b1f6366d3600f9012cae412cd3890

memory/2984-117-0x0000000140000000-0x0000000140227000-memory.dmp

memory/2984-113-0x00000000001F0000-0x00000000001F7000-memory.dmp

C:\Users\Admin\AppData\Local\9wz7ixG\EhStorAuthn.exe

MD5 3abe95d92c80dc79707d8e168d79a994
SHA1 64b10c17f602d3f21c84954541e7092bc55bb5ab
SHA256 2159d9d5c9355521de859d1c40907fcdfef19f8cf68eda7485b89e9aa119e3ad
SHA512 70fee5e87121229bba5c5e5aaa9f028ac0546dc9d38b7a00a81b882c8f8ce4abfdc364a598976b1463cca05e9400db715f8a4478ec61b03a693bbeee18c6ae5c

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\vggX8T0\EhStorAuthn.exe

MD5 bfd3f83302a2ee72fa811ee4f6643759
SHA1 ddc7e39087d686c641efe4df2424d1d73bcfe35a
SHA256 36b10dbadac14c62ffb04a77e5699ad3a9c4fb13869592e1672e11689aa6d7ab
SHA512 2f69987500ee4aee5d33a8e14a110550202e93f49b3c443c0a8f3c0deb0a8aa17ce5cf3ebc50e6afdc14f6d64be49376bcab754bcb5b54bacbc695dbfb2c78e6

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ekhyqsv.lnk

MD5 521833074b3b9d83d1d868d877d28cd8
SHA1 6e9ed43b753e29f6c17bb0202dba3d804bb89a40
SHA256 9805c035b401c663420da9e5f4a545867da82cc8d8ceba6fdd18c5b6d298f0ad
SHA512 3ca1fc567e2c67302913405fb061654245e64698b94fd54683fe5ac78f09b406fa571944a90d00c62ad669ebe41a68968b373a5748792f54716c9be6ff71da95

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low\S050eqUkG\NETPLWIZ.dll

MD5 72ad876ea34471375e5db72b2b58495e
SHA1 8cfc8ffd61b3868ac6156eeeec2014b2dac97a49
SHA256 2f529eac469d6d7b8d08b44853184295747017c668256d504f75ccb00dc4523c
SHA512 1e0a464ab6a3baee782ad732076a716010678f2c7ce0ceec60898765a086e1e7c841b65ddb823cba8f093b6c7996be84bca260565b8a44bec33de5d87683526e

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\N3zq3kLP\credui.dll

MD5 4a9a26a2a36e547cedf595e86f65cb50
SHA1 33f6c2d84c9664190cd062d801ea27a545325626
SHA256 13ec8e84ad225ca5b0ae6ad94e111f1f7b1cd8c8d413e36194c88895e1837f7f
SHA512 d6c0f17b266d012f053fd4b6b2b686877567efa4cc9aa865c68edc00e1e0c9e6401d9f3c8403bd9c24bfd5e0283cca37d0b3fd82fe3780628c99e7d5beb830de

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\vggX8T0\WTSAPI32.dll

MD5 73d0b46917185e932dfd6875a38ed2a8
SHA1 7a409a75fcf85aaf677c5e60ca3cd5c8e5fa5cce
SHA256 3f30c81cfe6c7c712094b1cbadee193d308e304719c8c6d65dfcb2621380d310
SHA512 c6f2ae9e59011844572708d29825d60f10b19de3576d37f5700b7b8a1c6c208171b896735bacc50c2787f50db92d41a8de8ac3ac111a3c15ad62b304a0baee27

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-30 23:08

Reported

2024-01-04 19:10

Platform

win10v2004-20231222-en

Max time kernel

3s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f757ecf4a083364ad33710c0020ba16.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f757ecf4a083364ad33710c0020ba16.dll,#1

C:\Users\Admin\AppData\Local\6IL\consent.exe

C:\Users\Admin\AppData\Local\6IL\consent.exe

C:\Users\Admin\AppData\Local\XA0U1Tc\CustomShellHost.exe

C:\Users\Admin\AppData\Local\XA0U1Tc\CustomShellHost.exe

C:\Windows\system32\CustomShellHost.exe

C:\Windows\system32\CustomShellHost.exe

C:\Users\Admin\AppData\Local\3y2\WFS.exe

C:\Users\Admin\AppData\Local\3y2\WFS.exe

C:\Windows\system32\WFS.exe

C:\Windows\system32\WFS.exe

C:\Windows\system32\consent.exe

C:\Windows\system32\consent.exe

C:\Users\Admin\AppData\Local\C75PG\wextract.exe

C:\Users\Admin\AppData\Local\C75PG\wextract.exe

C:\Windows\system32\wextract.exe

C:\Windows\system32\wextract.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 218.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 51.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 41.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 219.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
PH 23.37.1.183:80 tcp
PH 23.37.1.183:80 tcp

Files

memory/4740-0-0x000001B69AB70000-0x000001B69AB77000-memory.dmp

memory/4740-1-0x0000000140000000-0x0000000140226000-memory.dmp

memory/4740-7-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-14-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-19-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-25-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-30-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-34-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-35-0x0000000001230000-0x0000000001237000-memory.dmp

memory/3408-42-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-43-0x00007FFDED520000-0x00007FFDED530000-memory.dmp

memory/3408-54-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3556-69-0x0000000140000000-0x0000000140227000-memory.dmp

memory/3556-64-0x00000260B9290000-0x00000260B9297000-memory.dmp

memory/540-94-0x0000000140000000-0x0000000140227000-memory.dmp

memory/1116-105-0x000002725FE50000-0x000002725FE57000-memory.dmp

memory/1116-111-0x0000000140000000-0x0000000140227000-memory.dmp

memory/540-91-0x00000293453B0000-0x00000293453B7000-memory.dmp

memory/3556-63-0x0000000140000000-0x0000000140227000-memory.dmp

memory/3408-52-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-33-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-32-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-31-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-29-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-28-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-27-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-26-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-24-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-23-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-22-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-21-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-20-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-18-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-17-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-16-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-15-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-13-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-12-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-11-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-10-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-9-0x00007FFDEB92A000-0x00007FFDEB92B000-memory.dmp

memory/3408-8-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-6-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3408-4-0x0000000001280000-0x0000000001281000-memory.dmp