Malware Analysis Report

2024-11-30 21:29

Sample ID 231231-dep33scber
Target 2557b9e8fd400f73986bd17a42882036
SHA256 abbd188a78f45b3cc4d9e2f9e53a6e43d1c7c95a7769f268b70ff988f3b0c9ce
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

abbd188a78f45b3cc4d9e2f9e53a6e43d1c7c95a7769f268b70ff988f3b0c9ce

Threat Level: Known bad

The file 2557b9e8fd400f73986bd17a42882036 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-31 02:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-31 02:55

Reported

2024-01-02 01:01

Platform

win7-20231215-en

Max time kernel

164s

Max time network

143s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2557b9e8fd400f73986bd17a42882036.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\fgyel\eudcedit.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\S3PI\mstsc.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\CSDVouKe\rdpshell.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lgpbj = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\MACROM~1.COM\\support\\F3sT\\mstsc.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\fgyel\eudcedit.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\S3PI\mstsc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\CSDVouKe\rdpshell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1224 wrote to memory of 1964 N/A N/A C:\Windows\system32\eudcedit.exe
PID 1224 wrote to memory of 1964 N/A N/A C:\Windows\system32\eudcedit.exe
PID 1224 wrote to memory of 1964 N/A N/A C:\Windows\system32\eudcedit.exe
PID 1224 wrote to memory of 2212 N/A N/A C:\Users\Admin\AppData\Local\fgyel\eudcedit.exe
PID 1224 wrote to memory of 2212 N/A N/A C:\Users\Admin\AppData\Local\fgyel\eudcedit.exe
PID 1224 wrote to memory of 2212 N/A N/A C:\Users\Admin\AppData\Local\fgyel\eudcedit.exe
PID 1224 wrote to memory of 1764 N/A N/A C:\Windows\system32\mstsc.exe
PID 1224 wrote to memory of 1764 N/A N/A C:\Windows\system32\mstsc.exe
PID 1224 wrote to memory of 1764 N/A N/A C:\Windows\system32\mstsc.exe
PID 1224 wrote to memory of 1036 N/A N/A C:\Users\Admin\AppData\Local\S3PI\mstsc.exe
PID 1224 wrote to memory of 1036 N/A N/A C:\Users\Admin\AppData\Local\S3PI\mstsc.exe
PID 1224 wrote to memory of 1036 N/A N/A C:\Users\Admin\AppData\Local\S3PI\mstsc.exe
PID 1224 wrote to memory of 1056 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1224 wrote to memory of 1056 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1224 wrote to memory of 1056 N/A N/A C:\Windows\system32\rdpshell.exe
PID 1224 wrote to memory of 2472 N/A N/A C:\Users\Admin\AppData\Local\CSDVouKe\rdpshell.exe
PID 1224 wrote to memory of 2472 N/A N/A C:\Users\Admin\AppData\Local\CSDVouKe\rdpshell.exe
PID 1224 wrote to memory of 2472 N/A N/A C:\Users\Admin\AppData\Local\CSDVouKe\rdpshell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2557b9e8fd400f73986bd17a42882036.dll,#1

C:\Windows\system32\eudcedit.exe

C:\Windows\system32\eudcedit.exe

C:\Users\Admin\AppData\Local\fgyel\eudcedit.exe

C:\Users\Admin\AppData\Local\fgyel\eudcedit.exe

C:\Windows\system32\mstsc.exe

C:\Windows\system32\mstsc.exe

C:\Users\Admin\AppData\Local\S3PI\mstsc.exe

C:\Users\Admin\AppData\Local\S3PI\mstsc.exe

C:\Windows\system32\rdpshell.exe

C:\Windows\system32\rdpshell.exe

C:\Users\Admin\AppData\Local\CSDVouKe\rdpshell.exe

C:\Users\Admin\AppData\Local\CSDVouKe\rdpshell.exe

Network

N/A

Files

memory/2348-0-0x0000000001B60000-0x0000000001B67000-memory.dmp

memory/2348-1-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-4-0x0000000077606000-0x0000000077607000-memory.dmp

memory/1224-5-0x0000000002C40000-0x0000000002C41000-memory.dmp

memory/1224-8-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-9-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2348-7-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-12-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-11-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-16-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-18-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-19-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-20-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-23-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-24-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-22-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-21-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-26-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-28-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-27-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-33-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-34-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-39-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-42-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-44-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-45-0x0000000002C20000-0x0000000002C27000-memory.dmp

memory/1224-43-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-41-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-40-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-38-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-37-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-36-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-52-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-53-0x0000000077811000-0x0000000077812000-memory.dmp

memory/1224-54-0x0000000077970000-0x0000000077972000-memory.dmp

memory/1224-35-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-32-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-31-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-30-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-29-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-25-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-17-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-63-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-15-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-14-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-67-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-68-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-73-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-13-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1224-10-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2212-81-0x0000000000330000-0x0000000000337000-memory.dmp

memory/2212-82-0x0000000140000000-0x0000000140203000-memory.dmp

memory/1036-105-0x00000000001A0000-0x00000000001A7000-memory.dmp

memory/2472-129-0x00000000000F0000-0x00000000000F7000-memory.dmp

memory/1224-157-0x0000000077606000-0x0000000077607000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yiudzqwx.lnk

MD5 678241e37478987c6e9e87ba4d13bf80
SHA1 7468e645a64c616f4e825bf606c08d20a495c837
SHA256 92dd5707e8f5be050e09bd998b05f355f3fd9e766449d91c7356d12b37319699
SHA512 9d25eeb2c21ecae05e9f6455b559c305bcb822eadfaa24ea80918e669755aa6f26670d03f9a6c5fe7ac760f2700ea7c31158b9c4c4194a4f01d3955b3da8f9ab

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\a61w\MFC42u.dll

MD5 eef7c29776f148a1cc81806178594a05
SHA1 d4c54af997a69e4d3a1dca79cbac9afceb12544f
SHA256 5eab2bb4f39e7ada49179112d4eaaeedcdab58c5d77479630d3627df19c102d1
SHA512 c35110a4576c6466a37ecb25deb431d6d42b9861acb55426e901cb7e426bb55dc3cb93b12a54da6cb3281d950fc66831c412a3fd989558e9e2b07b09578c45ea

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\F3sT\Secur32.dll

MD5 3171abaf2c8cfe1eab79042753c89d67
SHA1 69b6c5a18a86ff8d6074d81d245cd6d257f439f5
SHA256 e8200849c9e7404003a29a4140efc1e7cec06b3d9b12d3a759a5ac91076a9b3e
SHA512 89ad1e4af38557d8fee5cbbcf0dec299b93cfec9abc18ddd691dbd4a90802b0cc8d9dbe651664feefa84d60639b3016c75dcb2bd673b9adfbb058e4c466e97da

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\ZMJ\WINSTA.dll

MD5 b0ba011cfe6d570276e906e50acf533f
SHA1 adb14b552601b5765086238837417a0ca811f059
SHA256 5bd1670da545c70b961bc2c0031af6d8dd74855e0211793a9c6eb23a6d5df0eb
SHA512 ef52095d6654e7c84c4b829f13ceec927c62e663c5adbd221c9e840b37b7ea5cd0d6fc1e3773234541c313df7903cf6d9dd0ffa2a1601d63480ce596b060e488

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-31 02:55

Reported

2024-01-02 00:59

Platform

win10v2004-20231215-en

Max time kernel

151s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2557b9e8fd400f73986bd17a42882036.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fidpgamyc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\a7dtHyL4\\upfc.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Xpm0J5d\SystemPropertiesComputerName.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Nco\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\UizS2W9\msconfig.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3364 wrote to memory of 1200 N/A N/A C:\Windows\system32\SystemPropertiesComputerName.exe
PID 3364 wrote to memory of 1200 N/A N/A C:\Windows\system32\SystemPropertiesComputerName.exe
PID 3364 wrote to memory of 3480 N/A N/A C:\Users\Admin\AppData\Local\Xpm0J5d\SystemPropertiesComputerName.exe
PID 3364 wrote to memory of 3480 N/A N/A C:\Users\Admin\AppData\Local\Xpm0J5d\SystemPropertiesComputerName.exe
PID 3364 wrote to memory of 3576 N/A N/A C:\Windows\system32\upfc.exe
PID 3364 wrote to memory of 3576 N/A N/A C:\Windows\system32\upfc.exe
PID 3364 wrote to memory of 1872 N/A N/A C:\Users\Admin\AppData\Local\Nco\upfc.exe
PID 3364 wrote to memory of 1872 N/A N/A C:\Users\Admin\AppData\Local\Nco\upfc.exe
PID 3364 wrote to memory of 4792 N/A N/A C:\Windows\system32\msconfig.exe
PID 3364 wrote to memory of 4792 N/A N/A C:\Windows\system32\msconfig.exe
PID 3364 wrote to memory of 2280 N/A N/A C:\Users\Admin\AppData\Local\UizS2W9\msconfig.exe
PID 3364 wrote to memory of 2280 N/A N/A C:\Users\Admin\AppData\Local\UizS2W9\msconfig.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2557b9e8fd400f73986bd17a42882036.dll,#1

C:\Windows\system32\SystemPropertiesComputerName.exe

C:\Windows\system32\SystemPropertiesComputerName.exe

C:\Users\Admin\AppData\Local\Xpm0J5d\SystemPropertiesComputerName.exe

C:\Users\Admin\AppData\Local\Xpm0J5d\SystemPropertiesComputerName.exe

C:\Windows\system32\upfc.exe

C:\Windows\system32\upfc.exe

C:\Users\Admin\AppData\Local\Nco\upfc.exe

C:\Users\Admin\AppData\Local\Nco\upfc.exe

C:\Windows\system32\msconfig.exe

C:\Windows\system32\msconfig.exe

C:\Users\Admin\AppData\Local\UizS2W9\msconfig.exe

C:\Users\Admin\AppData\Local\UizS2W9\msconfig.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 17.134.221.88.in-addr.arpa udp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

memory/4756-1-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4756-0-0x0000018B30910000-0x0000018B30917000-memory.dmp

memory/3364-4-0x0000000003100000-0x0000000003101000-memory.dmp

memory/3364-6-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-8-0x00007FF97588A000-0x00007FF97588B000-memory.dmp

memory/3364-9-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-10-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-7-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-11-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-12-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-13-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-15-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-16-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-21-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-22-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-23-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-26-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-28-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-29-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-31-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-30-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-27-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-25-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-24-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-20-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-19-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-18-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-17-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-14-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-34-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-36-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-35-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-33-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-32-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-38-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-40-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-39-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4756-37-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-41-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-44-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-45-0x00000000012D0000-0x00000000012D7000-memory.dmp

memory/3364-43-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-42-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-52-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-53-0x00007FF977020000-0x00007FF977030000-memory.dmp

memory/3364-62-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3364-64-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Users\Admin\AppData\Local\Xpm0J5d\SYSDM.CPL

MD5 625719a59a778c19c9af259d9167d554
SHA1 3073bd39238c6b1ba65037cf085275fdf25cbb3b
SHA256 c8e85cc2d78f2999c4b60dbbd013349a46e6253002cb8b5e52ed6a0c6d907982
SHA512 e5975c5d778b62bbb91a1e480d5b0f25f27765d6ce38dc933f25477210b0e89f0407deec6fd34b62595e134a8ba24f573188450b744d21efb5786ee1c65e45e2

memory/3480-74-0x000001BA0AA60000-0x000001BA0AA67000-memory.dmp

memory/3480-79-0x0000000140000000-0x00000001401FD000-memory.dmp

memory/3480-73-0x0000000140000000-0x00000001401FD000-memory.dmp

C:\Users\Admin\AppData\Local\Xpm0J5d\SYSDM.CPL

MD5 5fac22f0bcce02c121e17f243df76c3f
SHA1 462729fc846a0ad650da30d752a921b10cde5ddb
SHA256 9cfd1570f65a9f5d99d90db116eeb8f1491bf97445ae5801b1557a1c51daf233
SHA512 6cfe11e1385d1c88ee2d5eb4245abf88947872595adecefcd5ff26d245661eca8b5b9990a4fb33d31118ee40c19ae14864f02fa98c888bbf24d5f75eb0080c0d

C:\Users\Admin\AppData\Local\Xpm0J5d\SystemPropertiesComputerName.exe

MD5 1c37f93d98dcfc887818415997f1a0f8
SHA1 d3cdbfd84beb072afa66da841aef0fdd2ce6cbb0
SHA256 737fa9382d1b1782cd14c2338ad225753d9f8ff9b5e9920ec9bfa96bab48fe6b
SHA512 7f7e98209ecbe67c003b0f6862187568f2121795026a362cddd29c43c085984817f48cb70733de088568a2e9edd7158767e5c9c8ea3e2f7fcf6525841ffd4e31

C:\Users\Admin\AppData\Local\Nco\XmlLite.dll

MD5 0340e6c854b3ed7cc2bcf28bbd53ddc7
SHA1 e1c71631277689883397c24c92bb6ad6e4d62d39
SHA256 8178b8ea0e9c2d4ababc640cb56ee7d5f2005eb41376a6a48f84fca3892bf7dc
SHA512 33d1ca222963484880aab0071576d39abdbe600edbed9e986d59e18d1c3340c635e98cfb9430eccc07ca7354dd75589f6eb775a85fdb7243e9da130aca16b079

C:\Users\Admin\AppData\Local\Nco\XmlLite.dll

MD5 eaf31b951f9714b22652cf223d56ecde
SHA1 aacade6083f114bf19394e4fe33d19404ebb2eee
SHA256 852f8014f0d279e7ec7f6ee9fcf93560c257944d4dcd09c1709c733aac84633c
SHA512 f9a557d2b1f01c7681a86cbe3586d7e7d460677c44c37f8448b88720c7d1318305f58423903141a3ba27dff8abb1fb2dbbd04e8b88700d396e446262614f71d4

memory/1872-90-0x000002816D530000-0x000002816D537000-memory.dmp

memory/1872-96-0x0000000140000000-0x00000001401FD000-memory.dmp

C:\Users\Admin\AppData\Local\Nco\upfc.exe

MD5 14c93064e4f0749fd40be1261e58b022
SHA1 a490f19d7b205b684e9771f8bcf21141a80a0a8a
SHA256 6c8bec24eb6c295fb05ebdac9c103323498d35be26aeafb8fcf99bb6e9d29bc6
SHA512 c515b073daf88dae2aeff9c919d5cf42701557673b43fa64ece5cbc6893f063f16a298aa67a5ad40c589e23976caeb886702bc71205d5018493c8d538eb9d232

C:\Users\Admin\AppData\Local\UizS2W9\VERSION.dll

MD5 9a8bef64115bc94a05455f38cfb67a26
SHA1 7befb804b40af49b4f7c5b93aaa31a9d59c294e4
SHA256 66f3361d5e033882b3a2c18dc917c2b2214ab184839b6d72f5e35f22a3fa1c13
SHA512 089e9acec84af995c9f71b35c8b94242a07c441adc85c2b66e502be59d5e9669dc150dd9eed68eb175ce65a0bba9c6c51c345429dd2cbfe2d17cfecbcb7a53cf

memory/2280-107-0x0000017957360000-0x0000017957367000-memory.dmp

C:\Users\Admin\AppData\Local\UizS2W9\VERSION.dll

MD5 6a1d28a5dadd3f614b7b519ff539c23d
SHA1 6ed00af1688729c6415b46ea7089f20aa96253ba
SHA256 368c619b1f26751fae99a3348462f114e99c9da261a5ddc13dcd5be81a64e2e6
SHA512 23ef48a141cd428c21c218f79f40b06278cfe7f4a4fffc45d9a31218c8bcd47c9a47d47f4392014b274bde997fff6ffef8ea8858002cf67df0a7642081019e45

C:\Users\Admin\AppData\Local\UizS2W9\msconfig.exe

MD5 f941f806f6069a4f1104565ef9b9930a
SHA1 5f08545d0051c9eaefbcb937622259eef5ae73d6
SHA256 88cc4d15ea7ac5e401759ffd35de1f371a6f2e40b01bb7461254ba975fb4b5c9
SHA512 f91fdb313b06cb2caa73912fff11d2144ffcb11f6b67036fae2387604084f97e104fbc013d5cf04abb9ffd6ef2f03d04c387221c337f171a03360cfedbaeb710

C:\Users\Admin\AppData\Local\UizS2W9\msconfig.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Nco\upfc.exe

MD5 299ea296575ccb9d2c1a779062535d5c
SHA1 2497169c13b0ba46a6be8a1fe493b250094079b7
SHA256 ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA512 02fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Enpllr.lnk

MD5 f3bb0ae97f1a7a3a0a10bc68a0ca8450
SHA1 71b21bdc49212b25b779825c3f8202c196aece6a
SHA256 e756ff4d0ad7faaab8c09985e4195fd04b7e1864cce3d804392682fb175d992c
SHA512 43a8726f65bdc4893e058dcda6066b5c35de480bbb935f6b11e80cfb08e6f12efee2de1b873cd07b9e1bc4720ce28b8bda91a62c1b1c6eb6e24413aaaccc5b0e

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\cBugJLorY\SYSDM.CPL

MD5 8577240f511bd904ae8d20fd9224e90b
SHA1 b3fc9c7db98bd2ca13595b75eda740460c53aca3
SHA256 4baf7e68103af6c03dd32866ec0a2dc34c308543d65436b3d3ca70e943511503
SHA512 121d0c7d0721e8a65eb0a0e6c09c6d17bade9b55a8d7bec294102e8f0582063e9c8f11b17a3bba597466f221ac8b6b7b51ad629843dce56ed22cdade26384272

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\a7dtHyL4\XmlLite.dll

MD5 e8494748c3c588c73930fc29a77df2c6
SHA1 149585e65f9f64d22a170d5ba6e75314c1497c36
SHA256 ca2835cba3c56c30f36169746ac633f8179fd52b56d58a0e0e253cab2ad92f8d
SHA512 1200da310673bf706d422bd7d3107b3efb21a59455076bc0a5d4a3f1afd2ec6e142a7f69097a13f782ceb1a8b437039baf6312ace0dd11a69f99eb6c819c1a48

C:\Users\Admin\AppData\Roaming\Microsoft\Office\fUsPaB5Y4\VERSION.dll

MD5 71767e9681f74d1bccaa1ec69ef678ac
SHA1 c7c96ed46b071fe91bc0cc77fe7e4686f41ddd48
SHA256 22a16e7c37b76b7b8bd9026b8e5d9fbf7d54447de76b41b035979660cbb2f2cb
SHA512 b158b80980ef4e80c9b0a3d2d7b5bedb3f0ccd5e617466a2b31f55d7cecd01b7f030da6f6be058f2fe0fd1c658ca8a6da82e056cefc1de0e5067d17520eec8d7