Malware Analysis Report

2024-11-30 21:05

Sample ID 231230-ayzj3scgc8
Target 08bedb080824d80a2e3f3c661d0fd7b6
SHA256 8eb0acf8aec813cbfd4c211b6378c0ef99bab01e8ca96d468bdb6f05545f13f2
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8eb0acf8aec813cbfd4c211b6378c0ef99bab01e8ca96d468bdb6f05545f13f2

Threat Level: Known bad

The file 08bedb080824d80a2e3f3c661d0fd7b6 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex payload

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-30 00:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-30 00:37

Reported

2023-12-30 21:58

Platform

win7-20231215-en

Max time kernel

158s

Max time network

140s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\08bedb080824d80a2e3f3c661d0fd7b6.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\JQKTV\fvenotify.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Cx85\VaultSysUi.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\XId0H\SystemPropertiesRemote.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fskzoiv = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Fh\\VAULTS~1.EXE" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\JQKTV\fvenotify.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Cx85\VaultSysUi.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\XId0H\SystemPropertiesRemote.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1276 wrote to memory of 2192 N/A N/A C:\Windows\system32\fvenotify.exe
PID 1276 wrote to memory of 2192 N/A N/A C:\Windows\system32\fvenotify.exe
PID 1276 wrote to memory of 2192 N/A N/A C:\Windows\system32\fvenotify.exe
PID 1276 wrote to memory of 3000 N/A N/A C:\Users\Admin\AppData\Local\JQKTV\fvenotify.exe
PID 1276 wrote to memory of 3000 N/A N/A C:\Users\Admin\AppData\Local\JQKTV\fvenotify.exe
PID 1276 wrote to memory of 3000 N/A N/A C:\Users\Admin\AppData\Local\JQKTV\fvenotify.exe
PID 1276 wrote to memory of 2500 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1276 wrote to memory of 2500 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1276 wrote to memory of 2500 N/A N/A C:\Windows\system32\VaultSysUi.exe
PID 1276 wrote to memory of 1712 N/A N/A C:\Users\Admin\AppData\Local\Cx85\VaultSysUi.exe
PID 1276 wrote to memory of 1712 N/A N/A C:\Users\Admin\AppData\Local\Cx85\VaultSysUi.exe
PID 1276 wrote to memory of 1712 N/A N/A C:\Users\Admin\AppData\Local\Cx85\VaultSysUi.exe
PID 1276 wrote to memory of 2868 N/A N/A C:\Windows\system32\SystemPropertiesRemote.exe
PID 1276 wrote to memory of 2868 N/A N/A C:\Windows\system32\SystemPropertiesRemote.exe
PID 1276 wrote to memory of 2868 N/A N/A C:\Windows\system32\SystemPropertiesRemote.exe
PID 1276 wrote to memory of 2860 N/A N/A C:\Users\Admin\AppData\Local\XId0H\SystemPropertiesRemote.exe
PID 1276 wrote to memory of 2860 N/A N/A C:\Users\Admin\AppData\Local\XId0H\SystemPropertiesRemote.exe
PID 1276 wrote to memory of 2860 N/A N/A C:\Users\Admin\AppData\Local\XId0H\SystemPropertiesRemote.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\08bedb080824d80a2e3f3c661d0fd7b6.dll,#1

C:\Windows\system32\fvenotify.exe

C:\Windows\system32\fvenotify.exe

C:\Users\Admin\AppData\Local\JQKTV\fvenotify.exe

C:\Users\Admin\AppData\Local\JQKTV\fvenotify.exe

C:\Windows\system32\VaultSysUi.exe

C:\Windows\system32\VaultSysUi.exe

C:\Users\Admin\AppData\Local\Cx85\VaultSysUi.exe

C:\Users\Admin\AppData\Local\Cx85\VaultSysUi.exe

C:\Windows\system32\SystemPropertiesRemote.exe

C:\Windows\system32\SystemPropertiesRemote.exe

C:\Users\Admin\AppData\Local\XId0H\SystemPropertiesRemote.exe

C:\Users\Admin\AppData\Local\XId0H\SystemPropertiesRemote.exe

Network

N/A

Files

memory/1728-0-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1728-1-0x00000000001A0000-0x00000000001A7000-memory.dmp

memory/1276-3-0x0000000077116000-0x0000000077117000-memory.dmp

memory/1276-4-0x0000000002B60000-0x0000000002B61000-memory.dmp

memory/1276-7-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-9-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-10-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-13-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-12-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-11-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-15-0x0000000002B40000-0x0000000002B47000-memory.dmp

memory/1276-8-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-6-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-22-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-24-0x00000000774B0000-0x00000000774B2000-memory.dmp

memory/1276-23-0x0000000077480000-0x0000000077482000-memory.dmp

memory/1276-33-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1276-35-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1728-36-0x0000000140000000-0x00000001400AA000-memory.dmp

\Users\Admin\AppData\Local\JQKTV\fvenotify.exe

MD5 e61d644998e07c02f0999388808ac109
SHA1 183130ad81ff4c7997582a484e759bf7769592d6
SHA256 15a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512 310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272

memory/1276-48-0x0000000077116000-0x0000000077117000-memory.dmp

\Users\Admin\AppData\Local\JQKTV\slc.dll

MD5 40c10dad1ebaa77b1b5f17620ed610f1
SHA1 565b1b94e9b9fb8f6fb103c123b21a2b0bb18cf9
SHA256 dc5016c3b7438e582845d84afb0aea16ea05daab073478f1157b8136dc4d7ef1
SHA512 bbec384d3b5842c761a1e1322a1134660fb45cacaf4c4e73a664a56d7b0e3ea66db516a8356ca556ba804f6980327a0d96c6763ae9387ac45fa2d8d7a1872b06

memory/3000-51-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3000-52-0x0000000000740000-0x0000000000747000-memory.dmp

memory/3000-56-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Users\Admin\AppData\Local\Cx85\VaultSysUi.exe

MD5 f40ef105d94350d36c799ee23f7fec0f
SHA1 ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256 eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512 f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1

C:\Users\Admin\AppData\Local\Cx85\credui.dll

MD5 c4ca3c578fd58924b31f9bd159c54065
SHA1 1e19f12b71a27174b63f3710469c50060add5515
SHA256 143e0315b60fa7763d81341064ad1669b6f2d039a7f1e420b8055bdbd7226e72
SHA512 895f6635ea8975df7f7b008bd0c5818f8d8cbb8a9104d5c74eae0c6e0d09073e35fd8373da7928822caca3179e91de61a21f58fd20e56a3123d92337669c5433

memory/1712-71-0x00000000001F0000-0x00000000001F7000-memory.dmp

memory/1712-76-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Users\Admin\AppData\Local\XId0H\SystemPropertiesRemote.exe

MD5 d0d7ac869aa4e179da2cc333f0440d71
SHA1 e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA256 5762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA512 1808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7

C:\Users\Admin\AppData\Local\XId0H\SYSDM.CPL

MD5 8e79e6854c7e0096f277b0b0c753e4f9
SHA1 e62d8f90fef4d2b9fbc808013ea0e78a2e9f109e
SHA256 4aec3dfb2da21d053c646d48f0bf8055dc0e263e918b677e6ebda636772e6d3c
SHA512 c89a141ec563c368436d9667fc147e2560c205c6be0c2c7e202ae7947bc594c1713f3bbb595449c97d22dcf34dc0fa8c539b9dd30f98b4d443f75c0355e6544e

memory/2860-90-0x0000000000090000-0x0000000000097000-memory.dmp

memory/2860-93-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Zrkibbhbsqvuoso.lnk

MD5 e99c7dad44eca56720a08eea45440c68
SHA1 55cd0ced24447ee03bb4d99bd385767bfb79e8eb
SHA256 43be96a0faae78bc91edbcacb40d363ecf4ba083fde0544063f1cf74b9bcf1c1
SHA512 50134014c0199c436b0e214afa2016aa3b54a7690e1f78b2f4ab73fb6f621f8e220d2f4f904a5ccca373e26983a54e9f4b8ed6a8474c078aab163964c56d7265

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-30 00:37

Reported

2023-12-30 21:57

Platform

win10v2004-20231215-en

Max time kernel

160s

Max time network

167s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\08bedb080824d80a2e3f3c661d0fd7b6.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dturazvnnsjkgvr = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\NATIVE~1\\G2m\\SndVol.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\bmme\BitLockerWizard.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\uhvWjrXm\GamePanel.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\LEi\SndVol.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3416 wrote to memory of 3388 N/A N/A C:\Windows\system32\GamePanel.exe
PID 3416 wrote to memory of 3388 N/A N/A C:\Windows\system32\GamePanel.exe
PID 3416 wrote to memory of 1148 N/A N/A C:\Users\Admin\AppData\Local\uhvWjrXm\GamePanel.exe
PID 3416 wrote to memory of 1148 N/A N/A C:\Users\Admin\AppData\Local\uhvWjrXm\GamePanel.exe
PID 3416 wrote to memory of 3664 N/A N/A C:\Windows\system32\SndVol.exe
PID 3416 wrote to memory of 3664 N/A N/A C:\Windows\system32\SndVol.exe
PID 3416 wrote to memory of 1696 N/A N/A C:\Users\Admin\AppData\Local\LEi\SndVol.exe
PID 3416 wrote to memory of 1696 N/A N/A C:\Users\Admin\AppData\Local\LEi\SndVol.exe
PID 3416 wrote to memory of 740 N/A N/A C:\Windows\system32\BitLockerWizard.exe
PID 3416 wrote to memory of 740 N/A N/A C:\Windows\system32\BitLockerWizard.exe
PID 3416 wrote to memory of 3516 N/A N/A C:\Users\Admin\AppData\Local\bmme\BitLockerWizard.exe
PID 3416 wrote to memory of 3516 N/A N/A C:\Users\Admin\AppData\Local\bmme\BitLockerWizard.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\08bedb080824d80a2e3f3c661d0fd7b6.dll,#1

C:\Windows\system32\GamePanel.exe

C:\Windows\system32\GamePanel.exe

C:\Users\Admin\AppData\Local\uhvWjrXm\GamePanel.exe

C:\Users\Admin\AppData\Local\uhvWjrXm\GamePanel.exe

C:\Windows\system32\SndVol.exe

C:\Windows\system32\SndVol.exe

C:\Users\Admin\AppData\Local\LEi\SndVol.exe

C:\Users\Admin\AppData\Local\LEi\SndVol.exe

C:\Windows\system32\BitLockerWizard.exe

C:\Windows\system32\BitLockerWizard.exe

C:\Users\Admin\AppData\Local\bmme\BitLockerWizard.exe

C:\Users\Admin\AppData\Local\bmme\BitLockerWizard.exe

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 146.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 183.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 201.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/1712-0-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1712-1-0x000002CE037C0000-0x000002CE037C7000-memory.dmp

memory/3416-4-0x00007FF9B140A000-0x00007FF9B140B000-memory.dmp

memory/3416-3-0x0000000002C60000-0x0000000002C61000-memory.dmp

memory/3416-6-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-7-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-8-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-9-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-10-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-11-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-12-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-14-0x00000000010C0000-0x00000000010C7000-memory.dmp

memory/3416-13-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-22-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3416-24-0x00007FF9B22B0000-0x00007FF9B22C0000-memory.dmp

memory/3416-23-0x00007FF9B22C0000-0x00007FF9B22D0000-memory.dmp

memory/3416-33-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1712-36-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Users\Admin\AppData\Local\uhvWjrXm\GamePanel.exe

MD5 266f6a62c16f6a889218800762b137be
SHA1 31b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA256 71f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512 b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68

C:\Users\Admin\AppData\Local\uhvWjrXm\dxgi.dll

MD5 84d3a7a62aea27acfc6434f8e13cc3c0
SHA1 af366b598a331012325dbcb57d0276f800ba9804
SHA256 ab9a2862c1f7c85d7d6744f82bea11a85648ac6a1759e9503fe853cab002212f
SHA512 03bbea4de18a82cf32be5c82700585ec0f140b7bf0c06deab2019315251340143ec7a70576e58d61fe3e7479c4626138d032f09807116507139c2dd7cf838695

memory/1148-45-0x000002735DF60000-0x000002735DF67000-memory.dmp

memory/1148-44-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/1148-49-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Users\Admin\AppData\Local\LEi\SndVol.exe

MD5 c5d939ac3f9d885c8355884199e36433
SHA1 b8f277549c23953e8683746e225e7af1c193ad70
SHA256 68b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA512 8488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0

C:\Users\Admin\AppData\Local\LEi\UxTheme.dll

MD5 5f2008174a0661e0e3674c6769621c61
SHA1 0c98c91006d423369fc31589467f42bc8f5f3e01
SHA256 e094f4c71f037c305c046bdcc044bd03e68b5312b19399b309a04e61ee1c8678
SHA512 f4ce086e602f8dde0e1a91feb7cd0f7753e4377be2a9ed0f939dc4daca4849034edd5ab48e3b2ad6310afc8f9f869b83b5c40e3cd9927e074ed2b73d735603de

memory/1696-60-0x00000220A72D0000-0x00000220A72D7000-memory.dmp

memory/1696-65-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Users\Admin\AppData\Local\bmme\BitLockerWizard.exe

MD5 6d30c96f29f64b34bc98e4c81d9b0ee8
SHA1 4a3adc355f02b9c69bdbe391bfb01469dee15cf0
SHA256 7758227642702e645af5e84d1c0e5690e07687c8209072a2c5f79379299edf74
SHA512 25471b0ac7156d9ee9d12181020039bf551ba3efe252b656030c12d93b8db2648a18bdf762740f2a5cd8e43640e4bd4e8742310dea15823fc76b9e1c126876b8

C:\Users\Admin\AppData\Local\bmme\FVEWIZ.dll

MD5 7d6f3d9f65c7a09f0afda74ac06a8c49
SHA1 9167527229ca12210bb8fd0c47962ac9123c945b
SHA256 ba3c9d8925768bd1c0a77147fe08a477fb770f30ba494b1bf8aa5786ab4112d2
SHA512 d13e6023210e184603d6ae86d132d75d205dbe7e9044965da433ece883567fbbba63630015c3e6609550753a78144af956c487aefdd9f9b637fed9f01edcdb7d

memory/3516-76-0x00000289F3550000-0x00000289F3557000-memory.dmp

memory/3516-81-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dvizybqqo.lnk

MD5 860893ddc11761030d38ac4bccf4846f
SHA1 4731b7165329b4965793b1cd339829bb148b16e2
SHA256 9a435f3e0b6c10e879f3984f3eba9ec975d63801139863a267858d14a6083f18
SHA512 7484eb6e9be8d341140122c6be74d0f4379dfa9f9f2af066cd539e4bd7ec632fea0cff443e7bb36ad7f1339c2d521ce647cdf21bd39d0884158a6b8944b1f278