Malware Analysis Report

2024-11-30 21:47

Sample ID 240101-yqjqnahabk
Target c60920a9c292aa669035396b03965a08.exe
SHA256 4e37a17479c456a66c1b5bbc8204e65e2a7049852836df593d3cffad7ea546c9
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4e37a17479c456a66c1b5bbc8204e65e2a7049852836df593d3cffad7ea546c9

Threat Level: Known bad

The file c60920a9c292aa669035396b03965a08.exe was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Dridex payload

Loads dropped DLL

Executes dropped EXE

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Suspicious use of UnmapMainImage

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-01 19:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-01 19:59

Reported

2024-01-01 20:02

Platform

win7-20231215-en

Max time kernel

150s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\c60920a9c292aa669035396b03965a08.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\3tkL1Rc\wscript.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\kElcJ\iexpress.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\7w4\cmstp.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Srfjajs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\f3wl7BCm\\iexpress.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\kElcJ\iexpress.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\7w4\cmstp.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\3tkL1Rc\wscript.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1260 wrote to memory of 2568 N/A N/A C:\Windows\system32\wscript.exe
PID 1260 wrote to memory of 2568 N/A N/A C:\Windows\system32\wscript.exe
PID 1260 wrote to memory of 2568 N/A N/A C:\Windows\system32\wscript.exe
PID 1260 wrote to memory of 2616 N/A N/A C:\Users\Admin\AppData\Local\3tkL1Rc\wscript.exe
PID 1260 wrote to memory of 2616 N/A N/A C:\Users\Admin\AppData\Local\3tkL1Rc\wscript.exe
PID 1260 wrote to memory of 2616 N/A N/A C:\Users\Admin\AppData\Local\3tkL1Rc\wscript.exe
PID 1260 wrote to memory of 2192 N/A N/A C:\Windows\system32\iexpress.exe
PID 1260 wrote to memory of 2192 N/A N/A C:\Windows\system32\iexpress.exe
PID 1260 wrote to memory of 2192 N/A N/A C:\Windows\system32\iexpress.exe
PID 1260 wrote to memory of 1252 N/A N/A C:\Users\Admin\AppData\Local\kElcJ\iexpress.exe
PID 1260 wrote to memory of 1252 N/A N/A C:\Users\Admin\AppData\Local\kElcJ\iexpress.exe
PID 1260 wrote to memory of 1252 N/A N/A C:\Users\Admin\AppData\Local\kElcJ\iexpress.exe
PID 1260 wrote to memory of 1648 N/A N/A C:\Windows\system32\cmstp.exe
PID 1260 wrote to memory of 1648 N/A N/A C:\Windows\system32\cmstp.exe
PID 1260 wrote to memory of 1648 N/A N/A C:\Windows\system32\cmstp.exe
PID 1260 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\7w4\cmstp.exe
PID 1260 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\7w4\cmstp.exe
PID 1260 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\7w4\cmstp.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\c60920a9c292aa669035396b03965a08.dll,#1

C:\Windows\system32\wscript.exe

C:\Windows\system32\wscript.exe

C:\Users\Admin\AppData\Local\3tkL1Rc\wscript.exe

C:\Users\Admin\AppData\Local\3tkL1Rc\wscript.exe

C:\Windows\system32\iexpress.exe

C:\Windows\system32\iexpress.exe

C:\Users\Admin\AppData\Local\kElcJ\iexpress.exe

C:\Users\Admin\AppData\Local\kElcJ\iexpress.exe

C:\Windows\system32\cmstp.exe

C:\Windows\system32\cmstp.exe

C:\Users\Admin\AppData\Local\7w4\cmstp.exe

C:\Users\Admin\AppData\Local\7w4\cmstp.exe

Network

N/A

Files

memory/2252-1-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/2252-0-0x0000000000190000-0x0000000000197000-memory.dmp

memory/1260-3-0x0000000077176000-0x0000000077177000-memory.dmp

memory/1260-12-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-14-0x0000000002A20000-0x0000000002A27000-memory.dmp

memory/1260-13-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-11-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-10-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-9-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-8-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-7-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-6-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-4-0x0000000002A40000-0x0000000002A41000-memory.dmp

memory/1260-22-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-24-0x0000000077410000-0x0000000077412000-memory.dmp

memory/1260-23-0x00000000773E0000-0x00000000773E2000-memory.dmp

memory/1260-34-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/1260-33-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/2252-37-0x0000000140000000-0x00000001400E9000-memory.dmp

\Users\Admin\AppData\Local\3tkL1Rc\wscript.exe

MD5 8886e0697b0a93c521f99099ef643450
SHA1 851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256 d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512 fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837

C:\Users\Admin\AppData\Local\3tkL1Rc\VERSION.dll

MD5 bfcdafe69d90bd7023f8ad9a3010387e
SHA1 7fa6a02a6a2ded8ec7146ea384f61c9fa0dd783d
SHA256 2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073
SHA512 1a5f3d120c40656d9b8d44f21afbe4841426ff12c0b72e9ef9f493e2c519ae430bd631e3da7cfe90afe8c50e6096215d4dc898044f66922123f210024f46082e

memory/1260-54-0x0000000077176000-0x0000000077177000-memory.dmp

memory/2616-53-0x0000000140000000-0x00000001400EA000-memory.dmp

memory/2616-56-0x00000000000E0000-0x00000000000E7000-memory.dmp

memory/2616-59-0x0000000140000000-0x00000001400EA000-memory.dmp

\Users\Admin\AppData\Local\kElcJ\iexpress.exe

MD5 46fd16f9b1924a2ea8cd5c6716cc654f
SHA1 99284bc91cf829e9602b4b95811c1d72977700b6
SHA256 9f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA512 52c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629

memory/1252-71-0x0000000000400000-0x0000000000407000-memory.dmp

\Users\Admin\AppData\Local\kElcJ\VERSION.dll

MD5 e3131866f91556ad080fe2a779aa1b17
SHA1 df96ad3471403e2b98e66b15851280ea51e13291
SHA256 0fe4a1f561c62db783b0319724978bd87d6cd1cb2160c21cee7d6332e6376cb4
SHA512 288e9f5ce7ea185db87f0034cc39409c7d9fbbe334e6b71da5569d02d207103a343513985e15286771b841faaccb4bb5f4224bd0419d24d7967f65d71eb93d89

memory/1252-76-0x0000000140000000-0x00000001400EA000-memory.dmp

C:\Users\Admin\AppData\Local\7w4\VERSION.dll

MD5 103681d55ea151aab635948fccaca89e
SHA1 9a0951e0128004cf709d575d25c8d921cd566e74
SHA256 50312d9722c318e89a05ac1eb628de4dd92d8d51b66dea83e2cd3c433b9e798c
SHA512 05ec874e0fe9e536140edaba176a6e93bda42a5654141e887d84af00bda8e662966fc5dab71fff52e19543e6dacc86174330063d3ebc2b3f2378789cacefab76

C:\Users\Admin\AppData\Local\7w4\cmstp.exe

MD5 74c6da5522f420c394ae34b2d3d677e3
SHA1 ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA256 51d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512 bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a

\Users\Admin\AppData\Local\7w4\VERSION.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2560-90-0x0000000000270000-0x0000000000277000-memory.dmp

memory/2560-95-0x0000000140000000-0x00000001400EA000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ekhyqsv.lnk

MD5 776a5355699365a2bf1f6efdcb3e5800
SHA1 b92c5bd055e474e1d301bf529803ab8b45faf174
SHA256 e25fcf4a82409576f6a4a2ee01e36b0a19601c6c51a90bfe1bab88ba10f536a8
SHA512 1957401a919c9fd2a5d7849cb54173ee08092a505304f5d7320e6bcfeb072e700d20bd32ef235127070d577b979113c19b35f285692d2ec975832ef71ea7469a

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-01 19:59

Reported

2024-01-01 20:02

Platform

win10v2004-20231215-en

Max time kernel

159s

Max time network

169s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\c60920a9c292aa669035396b03965a08.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Dridex payload

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gdfgjdhwrlpouj = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\eDPKgBi\\msinfo32.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\2d3\msinfo32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\zKQH\msdt.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\HgDB\raserver.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3476 wrote to memory of 4828 N/A N/A C:\Windows\system32\raserver.exe
PID 3476 wrote to memory of 4828 N/A N/A C:\Windows\system32\raserver.exe
PID 3476 wrote to memory of 4672 N/A N/A C:\Users\Admin\AppData\Local\HgDB\raserver.exe
PID 3476 wrote to memory of 4672 N/A N/A C:\Users\Admin\AppData\Local\HgDB\raserver.exe
PID 3476 wrote to memory of 4016 N/A N/A C:\Windows\system32\msinfo32.exe
PID 3476 wrote to memory of 4016 N/A N/A C:\Windows\system32\msinfo32.exe
PID 3476 wrote to memory of 1584 N/A N/A C:\Users\Admin\AppData\Local\2d3\msinfo32.exe
PID 3476 wrote to memory of 1584 N/A N/A C:\Users\Admin\AppData\Local\2d3\msinfo32.exe
PID 3476 wrote to memory of 4068 N/A N/A C:\Windows\system32\msdt.exe
PID 3476 wrote to memory of 4068 N/A N/A C:\Windows\system32\msdt.exe
PID 3476 wrote to memory of 3520 N/A N/A C:\Users\Admin\AppData\Local\zKQH\msdt.exe
PID 3476 wrote to memory of 3520 N/A N/A C:\Users\Admin\AppData\Local\zKQH\msdt.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\c60920a9c292aa669035396b03965a08.dll,#1

C:\Windows\system32\raserver.exe

C:\Windows\system32\raserver.exe

C:\Users\Admin\AppData\Local\HgDB\raserver.exe

C:\Users\Admin\AppData\Local\HgDB\raserver.exe

C:\Windows\system32\msinfo32.exe

C:\Windows\system32\msinfo32.exe

C:\Users\Admin\AppData\Local\2d3\msinfo32.exe

C:\Users\Admin\AppData\Local\2d3\msinfo32.exe

C:\Windows\system32\msdt.exe

C:\Windows\system32\msdt.exe

C:\Users\Admin\AppData\Local\zKQH\msdt.exe

C:\Users\Admin\AppData\Local\zKQH\msdt.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 147.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 2.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 167.109.18.2.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 57.110.18.2.in-addr.arpa udp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/4052-1-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/4052-0-0x000002525E520000-0x000002525E527000-memory.dmp

memory/3476-3-0x00000000030C0000-0x00000000030C1000-memory.dmp

memory/3476-6-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-8-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-9-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-10-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-7-0x00007FF9BF6DA000-0x00007FF9BF6DB000-memory.dmp

memory/3476-5-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-11-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-13-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-12-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-14-0x00000000088F0000-0x00000000088F7000-memory.dmp

memory/4052-22-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-23-0x0000000140000000-0x00000001400E9000-memory.dmp

memory/3476-24-0x00007FF9C0740000-0x00007FF9C0750000-memory.dmp

memory/3476-25-0x00007FF9C0730000-0x00007FF9C0740000-memory.dmp

memory/3476-35-0x0000000140000000-0x00000001400E9000-memory.dmp

C:\Users\Admin\AppData\Local\HgDB\raserver.exe

MD5 d1841c6ee4ea45794ced131d4b68b60e
SHA1 4be6d2116060d7c723ac2d0b5504efe23198ea01
SHA256 38732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d
SHA512 d8bad215872c5956c6e8acac1cd3ad19b85f72b224b068fb71cfd1493705bc7d3390853ba923a1aa461140294f8793247df018484a378e4f026c2a12cb3fa5c9

C:\Users\Admin\AppData\Local\HgDB\WTSAPI32.dll

MD5 401f84a3215161405db7ecf1f1d0b6f4
SHA1 7b2517a60daac43ab7d5f12f3c5f10c40221c46d
SHA256 bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774
SHA512 3b4598da32edd45909e44067d8fd0aa65a30d21deb908c2ba0a7e2ee1f1d9b4e362161238c47305fecfd36f38a99da9d39d0f1e242ae337d8fc4525eac96b183

memory/4672-45-0x0000000140000000-0x00000001400EA000-memory.dmp

memory/4672-44-0x000001BD891B0000-0x000001BD891B7000-memory.dmp

memory/4672-49-0x0000000140000000-0x00000001400EA000-memory.dmp

C:\Users\Admin\AppData\Local\2d3\msinfo32.exe

MD5 0aed91da63713bf9f881b03a604a1c9d
SHA1 b1b2d292cb1a4c13dc243b5eab13afb316a28b9a
SHA256 5cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14
SHA512 04bca9b321d702122b6e72c2ad15b7cd98924e5dfc3b8dd0e907ea28fd7826d3f72b98c67242b6698594df648d3c2b6b0952bb52a2363b687bbe44a66e830c03

C:\Users\Admin\AppData\Local\2d3\SLC.dll

MD5 8eef978c00b27044f919df7c554d5520
SHA1 cebd31232222956453ec07290acf6acd42bf1ba7
SHA256 9b2a6a5b076828f7f0a821e254c49bf74abed0b9974f3fe6f74414210e71ac8c
SHA512 1be501d0c1770bc5cb35ef26afb8d7670983888b2d7ce9ab26b3cbbd9d9d582437111ec43b060d6b378df3af9888501e81f03b5506d13e775ae2172d3d84bd41

memory/1584-62-0x000001C80AB90000-0x000001C80AB97000-memory.dmp

memory/1584-65-0x0000000140000000-0x00000001400EA000-memory.dmp

C:\Users\Admin\AppData\Local\zKQH\msdt.exe

MD5 992c3f0cc8180f2f51156671e027ae75
SHA1 942ec8c2ccfcacd75a1cd86cbe8873aee5115e29
SHA256 6859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f
SHA512 1f1b8d39e29274cfc87a9ef1510adb9c530086a421c121523376731c8933c6e234e9146310d3767ce888a8dce7a5713221f4d25e5b7b6398d06ae2be2b99eadf

C:\Users\Admin\AppData\Local\zKQH\Secur32.dll

MD5 03b5687f88d38e7633c38da183cf2136
SHA1 bc436ad961d5695942a16cdaf5537557303ed395
SHA256 a3c82a5d0423dd286da22159254ce44db5fadc717abfe58240ab7bbf1acfd252
SHA512 cbea474e44f0c9cff8cf9d4cc1dfcc3578bb49030668fbd0f5fdcc01cf110cb5582a833a2abeae39b17ea2366d6d2706231bfcae56c7c1db0da11039c528ec68

memory/3520-76-0x0000021F0FE50000-0x0000021F0FE57000-memory.dmp

memory/3520-81-0x0000000140000000-0x00000001400EA000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Btpzaqnqvnv.lnk

MD5 69e32521e4c977b5e69cfd6a91b978a6
SHA1 6439abd29e9b032c477428c73de18b7b2cd80fe1
SHA256 b87797f7b7903422e7bd4209570735f135ce0808becc32b541acbd1c655a2aea
SHA512 e8421d1c93fdaebb28628b8922c552e3e01416f6b1890cdbd8ff0500370ff7aba13863f77f6abf2c8f8c97a2819d3c00cde89d513ca28a596ea7434fa3965795