Malware Analysis Report

2024-11-13 16:42

Sample ID 240201-c3fnwabdgq
Target 82a4bc5335713f3201927604dc1c17fa.bin
SHA256 b24b5a97da7b45c297575085b7e6a6812e70391a8460609e4ab225c8b8c421b8
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b24b5a97da7b45c297575085b7e6a6812e70391a8460609e4ab225c8b8c421b8

Threat Level: Known bad

The file 82a4bc5335713f3201927604dc1c17fa.bin was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-01 02:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-01 02:35

Reported

2024-02-01 02:38

Platform

win7-20231215-en

Max time kernel

150s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\82a4bc5335713f3201927604dc1c17fa.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zqonzshwxyr = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\MAINTE~1\\HB04N6~1\\MPSIGS~1.EXE" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1420 wrote to memory of 3056 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1420 wrote to memory of 3056 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1420 wrote to memory of 3056 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1420 wrote to memory of 2436 N/A N/A C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe
PID 1420 wrote to memory of 2436 N/A N/A C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe
PID 1420 wrote to memory of 2436 N/A N/A C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe
PID 1420 wrote to memory of 1372 N/A N/A C:\Windows\system32\MpSigStub.exe
PID 1420 wrote to memory of 1372 N/A N/A C:\Windows\system32\MpSigStub.exe
PID 1420 wrote to memory of 1372 N/A N/A C:\Windows\system32\MpSigStub.exe
PID 1420 wrote to memory of 2888 N/A N/A C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe
PID 1420 wrote to memory of 2888 N/A N/A C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe
PID 1420 wrote to memory of 2888 N/A N/A C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe
PID 1420 wrote to memory of 2064 N/A N/A C:\Windows\system32\rdpclip.exe
PID 1420 wrote to memory of 2064 N/A N/A C:\Windows\system32\rdpclip.exe
PID 1420 wrote to memory of 2064 N/A N/A C:\Windows\system32\rdpclip.exe
PID 1420 wrote to memory of 1464 N/A N/A C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe
PID 1420 wrote to memory of 1464 N/A N/A C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe
PID 1420 wrote to memory of 1464 N/A N/A C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\82a4bc5335713f3201927604dc1c17fa.dll,#1

C:\Windows\system32\Dxpserver.exe

C:\Windows\system32\Dxpserver.exe

C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe

C:\Users\Admin\AppData\Local\3qL8\Dxpserver.exe

C:\Windows\system32\MpSigStub.exe

C:\Windows\system32\MpSigStub.exe

C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe

C:\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe

C:\Windows\system32\rdpclip.exe

C:\Windows\system32\rdpclip.exe

C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe

C:\Users\Admin\AppData\Local\5mJA\rdpclip.exe

Network

N/A

Files

memory/828-1-0x00000000004B0000-0x00000000004B7000-memory.dmp

memory/828-0-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-4-0x00000000771B6000-0x00000000771B7000-memory.dmp

memory/1420-5-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

memory/828-8-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-7-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-9-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-10-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-11-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-12-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-13-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-14-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-15-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-16-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-17-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-18-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-19-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-20-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-21-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-22-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-24-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-23-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-26-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-25-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-27-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-28-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-29-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-30-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-31-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-32-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-33-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-34-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-35-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-36-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-38-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-39-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-37-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-40-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-41-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-42-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-43-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-44-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-46-0x0000000002A70000-0x0000000002A77000-memory.dmp

memory/1420-45-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-53-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-54-0x00000000773C1000-0x00000000773C2000-memory.dmp

memory/1420-55-0x0000000077520000-0x0000000077522000-memory.dmp

memory/1420-64-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/1420-70-0x0000000140000000-0x00000001401BD000-memory.dmp

\Users\Admin\AppData\Local\3qL8\Dxpserver.exe

MD5 4d38389fb92e43c77a524fd96dbafd21
SHA1 08014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256 070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA512 02d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba

C:\Users\Admin\AppData\Local\3qL8\XmlLite.dll

MD5 7ddea799917208e8c09706692f7b2b9d
SHA1 9cd88c64b018f42873252c13ed6bfd84e15658f9
SHA256 c15c3d6ce355c8fc5432cf6bb58b62a00c25966fc07a75a04e7f542f7dffa74d
SHA512 644b7937a28ee897dcd32cf69ebe242824bfecba19f20f846e29a03b94f3c2a0570402da756e8b3d3e9962c719f52527e3194d8dde0115022e435e79c159ecb8

memory/2436-82-0x0000000140000000-0x00000001401BE000-memory.dmp

memory/2436-83-0x0000000000080000-0x0000000000087000-memory.dmp

\Users\Admin\AppData\Local\nbYXZm\MpSigStub.exe

MD5 2e6bd16aa62e5e95c7b256b10d637f8f
SHA1 350be084477b1fe581af83ca79eb58d4defe260f
SHA256 d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA512 1f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542

C:\Users\Admin\AppData\Local\nbYXZm\VERSION.dll

MD5 4ebd2394fa6661a3583ec9e3e16438dd
SHA1 7491b01fc1e9b130a1381cd6b80d2a895a76e6bb
SHA256 4894a94be835028a32c05fb911e847fead89d36ad02970285d6da6e474af370d
SHA512 95b80b6fa08a815a7d4dd9335f21073e6f64e0fef1ed3e8d0500642ed67c12d29919e20a51fc3f1050d41ea44b1926fde878e168141f1ed91db8c7ad134991a8

memory/2888-100-0x00000000000F0000-0x00000000000F7000-memory.dmp

\Users\Admin\AppData\Local\5mJA\rdpclip.exe

MD5 25d284eb2f12254c001afe9a82575a81
SHA1 cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256 837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA512 7b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b

C:\Users\Admin\AppData\Local\5mJA\WTSAPI32.dll

MD5 ce077bd26ddf35a45bb35299dcfab262
SHA1 d5306e834f7fee74bc5181c8211c6f22441bf794
SHA256 9b2b07f731e4195112fa0da1a91f5f4496d5256c9d2af3602074642dac5a6d17
SHA512 dcff0f95e170155e7e3ec3f5f4e5b69df2b13c31e4ab4e3e0b3acb531ea2007301351cedd926436cb79561d026338a4a4d48fc022018c1bf6484b35419fe5d49

memory/1464-118-0x0000000000100000-0x0000000000107000-memory.dmp

memory/1420-140-0x00000000771B6000-0x00000000771B7000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

MD5 efb971c697b8c2f47f4dce70769f9765
SHA1 79ce970a44f2693a788740dd289c438bd632d4c9
SHA256 0ac827ec4558c7f427a14b79d932050eee6b5ea4209abbc992f1336aeebd2247
SHA512 fe06c3ff7aed5d7620d4c178296f453558ad565221cbf384cff777b53d12d515ab3f4715bf3cca19c97246c934515476ef694197b9cf2491fbd7455cde962c9c

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-01 02:35

Reported

2024-02-01 02:38

Platform

win10v2004-20231215-en

Max time kernel

149s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\82a4bc5335713f3201927604dc1c17fa.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qzenv = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Proof\\Wqv1ITs6vhQ\\PasswordOnWakeSettingFlyout.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\zPf2pb\SystemPropertiesDataExecutionPrevention.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\mf5Sd4IMu\OptionalFeatures.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\avzwyZY9\PasswordOnWakeSettingFlyout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3420 wrote to memory of 4072 N/A N/A C:\Windows\system32\OptionalFeatures.exe
PID 3420 wrote to memory of 4072 N/A N/A C:\Windows\system32\OptionalFeatures.exe
PID 3420 wrote to memory of 4564 N/A N/A C:\Users\Admin\AppData\Local\mf5Sd4IMu\OptionalFeatures.exe
PID 3420 wrote to memory of 4564 N/A N/A C:\Users\Admin\AppData\Local\mf5Sd4IMu\OptionalFeatures.exe
PID 3420 wrote to memory of 796 N/A N/A C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
PID 3420 wrote to memory of 796 N/A N/A C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
PID 3420 wrote to memory of 1840 N/A N/A C:\Users\Admin\AppData\Local\avzwyZY9\PasswordOnWakeSettingFlyout.exe
PID 3420 wrote to memory of 1840 N/A N/A C:\Users\Admin\AppData\Local\avzwyZY9\PasswordOnWakeSettingFlyout.exe
PID 3420 wrote to memory of 4604 N/A N/A C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
PID 3420 wrote to memory of 4604 N/A N/A C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
PID 3420 wrote to memory of 1900 N/A N/A C:\Users\Admin\AppData\Local\zPf2pb\SystemPropertiesDataExecutionPrevention.exe
PID 3420 wrote to memory of 1900 N/A N/A C:\Users\Admin\AppData\Local\zPf2pb\SystemPropertiesDataExecutionPrevention.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\82a4bc5335713f3201927604dc1c17fa.dll,#1

C:\Windows\system32\OptionalFeatures.exe

C:\Windows\system32\OptionalFeatures.exe

C:\Users\Admin\AppData\Local\mf5Sd4IMu\OptionalFeatures.exe

C:\Users\Admin\AppData\Local\mf5Sd4IMu\OptionalFeatures.exe

C:\Windows\system32\PasswordOnWakeSettingFlyout.exe

C:\Windows\system32\PasswordOnWakeSettingFlyout.exe

C:\Users\Admin\AppData\Local\zPf2pb\SystemPropertiesDataExecutionPrevention.exe

C:\Users\Admin\AppData\Local\zPf2pb\SystemPropertiesDataExecutionPrevention.exe

C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe

C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe

C:\Users\Admin\AppData\Local\avzwyZY9\PasswordOnWakeSettingFlyout.exe

C:\Users\Admin\AppData\Local\avzwyZY9\PasswordOnWakeSettingFlyout.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

memory/2536-1-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/2536-0-0x0000015F9A020000-0x0000015F9A027000-memory.dmp

memory/3420-4-0x0000000002380000-0x0000000002381000-memory.dmp

memory/2536-7-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-9-0x00007FF861CBA000-0x00007FF861CBB000-memory.dmp

memory/3420-10-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-14-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-13-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-15-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-12-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-20-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-25-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-24-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-27-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-30-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-31-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-33-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-34-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-32-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-29-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-28-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-26-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-23-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-22-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-21-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-19-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-18-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-17-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-16-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-11-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-8-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-6-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-35-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-40-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-43-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-45-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-44-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-42-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-47-0x0000000000920000-0x0000000000927000-memory.dmp

memory/3420-53-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-54-0x00007FF862540000-0x00007FF862550000-memory.dmp

memory/3420-41-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-65-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-63-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-38-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-39-0x0000000140000000-0x00000001401BD000-memory.dmp

memory/3420-37-0x0000000140000000-0x00000001401BD000-memory.dmp

C:\Users\Admin\AppData\Local\mf5Sd4IMu\appwiz.cpl

MD5 d64959f0f7f89bf75ae055a344a1162e
SHA1 6a76396db0582d618b9faee4e92f80c779ff35eb
SHA256 81795d242b08b7dc4e7b4fe058cc2d35e4157187faee0e010785163e3cc1002d
SHA512 92e400d4d71b5d9f6dcad972b4c1e97bfab2686ecc283c109e3d231dc6287b55ad1696ee1e3fc205f057358e1317903f32791ffe91ebe44dce96b7d7e97c86a2

memory/4564-80-0x0000000140000000-0x00000001401BE000-memory.dmp

memory/4564-75-0x0000000140000000-0x00000001401BE000-memory.dmp

C:\Users\Admin\AppData\Local\mf5Sd4IMu\OptionalFeatures.exe

MD5 ee13a233eb959951089a6f3851ca156f
SHA1 0c7c8f3b8d59b71e18b945ea87b4f6aa8f8e0155
SHA256 d99b2316d6acf0cd88e588ea20c5bad648db2e83ba88ca2e7644123510ecd5a3
SHA512 6e196f4454dfb4f09adf35425f477b95eedb82695f72ad0fc510710c1acb1cf1481aeda0ba2c4b18ebc0959afd34bf9521643b7ea4f7a8b500b8be927255a190

memory/4564-74-0x00000298B03B0000-0x00000298B03B7000-memory.dmp

C:\Users\Admin\AppData\Local\mf5Sd4IMu\appwiz.cpl

MD5 9ee1da5125f3f7d341e616024a605d3c
SHA1 dde8933554566af7ee66685c50df2aa43ca61932
SHA256 881b7239eaa5a7fdf6b1b1b0341dbb9ef7f02b6673331eadf3b21fa7f5b39f14
SHA512 014e590126dec698c413fbbbc07113945eeb63669de981553ad5f51091fb269022846a88d1a9ec2568a7a7e4679aef6f2c41d986b0004dc5d6be2b75e8dae37a

C:\Users\Admin\AppData\Local\mf5Sd4IMu\OptionalFeatures.exe

MD5 d6cd8bef71458804dbc33b88ace56372
SHA1 a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256 fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA512 1bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d

memory/3420-36-0x0000000140000000-0x00000001401BD000-memory.dmp

C:\Users\Admin\AppData\Local\avzwyZY9\PasswordOnWakeSettingFlyout.exe

MD5 591a98c65f624c52882c2b238d6cd4c4
SHA1 c960d08c19d777069cf265dcc281807fbd8502d7
SHA256 5e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA512 1999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074

memory/1840-94-0x0000014B17C10000-0x0000014B17C17000-memory.dmp

memory/1840-97-0x0000000140000000-0x0000000140203000-memory.dmp

memory/1840-91-0x0000000140000000-0x0000000140203000-memory.dmp

memory/1900-110-0x000001FC20270000-0x000001FC20277000-memory.dmp

C:\Users\Admin\AppData\Local\zPf2pb\SYSDM.CPL

MD5 b640622fbb50e4d66f5a5e245a0aef53
SHA1 0ba5d7149672b2ff51a756b6fde24fc8a0c5e1b3
SHA256 6be3250b25c77ae554dbabdb2a660833860effb9989b8415a3cacd9370b00176
SHA512 799ef005df268ef7be612d1028b077da133ec7cbcb7d1d1edbc2a0cf87d3a822b6e73b26287ed4bd40c7ab76f96b10e09e64e3760d2734f761c50fb7a77b5b84

C:\Users\Admin\AppData\Local\zPf2pb\SYSDM.CPL

MD5 55b8a5d916e3fe90fc82b46c2dbb6d7d
SHA1 e73b72a0bb092d3e5a2d0dbe4ffaf2baa95399db
SHA256 1a62114627c6bfcd97b3fe94bf3cd9b7be60878b193f21ae0cb094bda6107c38
SHA512 c56da37a79aa1a272154c2e6dbdb8dfec3ccb349f27a3bf85bf6116b3b7f104380f2888f97047764ba25febb3b0d54f2a58915130fc763d8f8f5d06eed1c1258

C:\Users\Admin\AppData\Local\zPf2pb\SystemPropertiesDataExecutionPrevention.exe

MD5 0765ec61d6cda10698e0232b87a88792
SHA1 b00a117fc66e9406d4448b1198c00a0900cd20f3
SHA256 b12a18dc7e44954a5f51155855711fb06294aadba0eafb034260fd1507e79c7d
SHA512 a661bd514166c8762aa5d6cf07929836bb2a72c706d76072c6b8342e4c9709798a462b4031a216503ccfde93fc911390ee92845bac7390cf0b3d77f5aa8a717d

C:\Users\Admin\AppData\Local\zPf2pb\SystemPropertiesDataExecutionPrevention.exe

MD5 05aa388eb8cce0f37a3754810e607d00
SHA1 9d3a3bfd41895679b244ad15a98b799f2559c6b0
SHA256 81140bbf67740e130f099262b0f8cd46dc875ba1634d3480d8eacc4593d38e7d
SHA512 6829a51d9a022815f2df9a64cbc7b599c6a6e0f635e116e8ebb54449a67423ca493f6c40c1ab8eb17984376db3f651c59f6838761bb7620f45ea9d9b7e46ed25

C:\Users\Admin\AppData\Local\avzwyZY9\DUI70.dll

MD5 584dd31ef5a32657deb402ee7cdb9b1f
SHA1 6845258f3a192fcff0a8e68f2a966fd66b982a94
SHA256 aeecaf1c69ab6346eb463a8af04e8afd35b9e812725d41aef9464548cd55923a
SHA512 839ae7a40d627d5de29865c8ea573ecd3cbfd89a6ae1b890f697c95e9d9216d7414515ab99c5f8254178fb1d289055b69f5a06d6c9b7301dc28502dee580376d

C:\Users\Admin\AppData\Local\avzwyZY9\DUI70.dll

MD5 51d3e554d3cce3434b641294651ff811
SHA1 e23df17221045165335b1983aaf3cdd4d6194540
SHA256 89d24e39a7da3552f521ed68287c30de1b40b37771e4128c7782df8a00808f0e
SHA512 18cbc1a17c4a6e79be8b5becd1a6b5994cc59e2dcd299cf9178641e5f7e9af6ba766e904f33c941be16db9728bffa3fca8eaea87280073f84cd98b0c220f8b7d

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Iydemppuyghrhln.lnk

MD5 861ea6a963fcb20355fb7a82c608ac48
SHA1 fb4e2fd8bcede2b17857b2aa2467948894128172
SHA256 c5d23876c9444273da162b6e07f24bfc526df6578a2fef20cf834f710dbb1249
SHA512 b6d511aab58b66397852d79dde1061ab52dfdc2122021ee8c809770b1053d02589cb5e916095ca428591345d30440bb750b71d86cc73a880fa5c38303ef1c516

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\3zP\appwiz.cpl

MD5 aaf9507719f363ef66a61bcb78bfafa8
SHA1 d6593e049f46484679e9e220b030a96a49b49321
SHA256 cf2b65fe1a16299ad7ac668b6b596d4d3e36e39244a3203639df272b81ba2156
SHA512 51df54d5b713384fde72e03761620cd1c4d78afb6b1f39f83accd162a8f88d2fdc8f4ff1389a5d924bdba70ab077173bfa4a9236306cb0b58083e77eedb80af9

C:\Users\Admin\AppData\Roaming\Microsoft\Proof\Wqv1ITs6vhQ\DUI70.dll

MD5 d9e01f89c61a44ea98d1b6df2a3ceb11
SHA1 2f1f538c1426bf63c2eccbed8f45a014186857e3
SHA256 664b261f47100910102c47cbeb63baa5a6c0ee53a5ff87086ff7ff448b187f1e
SHA512 0cf2c988bc7bdb598ac91fb7c6973a0f9f0eb0ab01f4b5b560599ebee7a9f3f76b9228635d79c9ad8e273c6d25273a9be73faf18d1bed4f044319f5d57b11621

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\MYRX\SYSDM.CPL

MD5 36f7b03ace3ec17ed612922a4eebc4e8
SHA1 bfc840d631bc69b5ace2dd14656a35b8eb329bcb
SHA256 fd3f8a16a4a3e42711ff5878523cd00ad12ab83728e9b147780408f5a893b3c1
SHA512 e0bf8837aa2c55932acb958079ca1d28a2e287c3757007123cc0b8d91a7392332303e5878d6841ed461a9fb467e3e36697e4f33bad9abc3396686e39d53fb86e