Analysis Overview
SHA256
1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518
Threat Level: Known bad
The file 1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518 was found to be: Known bad.
Malicious Activity Summary
Lockbit
Executes dropped EXE
Loads dropped DLL
Suspicious use of NtSetInformationThreadHideFromDebugger
Unsigned PE
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-03-14 04:07
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-03-14 04:07
Reported
2024-03-14 04:09
Platform
win7-20240221-en
Max time kernel
118s
Max time network
119s
Command Line
Signatures
Lockbit
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\BB4.tmp | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\ProgramData\BB4.tmp | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\ProgramData\BB4.tmp | N/A |
| N/A | N/A | C:\ProgramData\BB4.tmp | N/A |
| N/A | N/A | C:\ProgramData\BB4.tmp | N/A |
| N/A | N/A | C:\ProgramData\BB4.tmp | N/A |
| N/A | N/A | C:\ProgramData\BB4.tmp | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1
C:\ProgramData\BB4.tmp
"C:\ProgramData\BB4.tmp"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BB4.tmp >> NUL
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x14c
Network
Files
memory/1780-0-0x0000000000910000-0x0000000000950000-memory.dmp
C:\Users\ndVkYtjAf.README.txt
| MD5 | fca975e2563293f289d47a8c9fe897af |
| SHA1 | 09de20439fbf20d936baa6ac0cebccbf34ef87cf |
| SHA256 | 301600771cf58007cab8b74a95c4c5549f18e4cf86cf332b0545bfa4cae9e5aa |
| SHA512 | 0b3c9882465e879ac55a621189f5597051cde4658126be290f7fd0ac274b9a5f9fe362866f485298ca6743e32a50c39f9a68b6af05363987c3513dd7a67c4c7c |
\ProgramData\BB4.tmp
| MD5 | 294e9f64cb1642dd89229fff0592856b |
| SHA1 | 97b148c27f3da29ba7b18d6aee8a0db9102f47c9 |
| SHA256 | 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2 |
| SHA512 | b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf |
memory/1392-208-0x000000007EFA0000-0x000000007EFA1000-memory.dmp
memory/1780-210-0x0000000000C85000-0x0000000000CBD000-memory.dmp
memory/1392-209-0x00000000020F0000-0x0000000002130000-memory.dmp
memory/1392-206-0x0000000000400000-0x0000000000407000-memory.dmp
memory/1780-211-0x0000000000CBD000-0x0000000000CC0000-memory.dmp
memory/1392-214-0x00000000020F0000-0x0000000002130000-memory.dmp
memory/1392-212-0x000000007EF80000-0x000000007EF81000-memory.dmp
memory/1392-213-0x000000007EF20000-0x000000007EF21000-memory.dmp
memory/1392-215-0x0000000000400000-0x0000000000407000-memory.dmp
memory/1392-216-0x00000000020F0000-0x0000000002130000-memory.dmp
memory/1392-219-0x000000007EF40000-0x000000007EF41000-memory.dmp
memory/1392-220-0x000000007EF60000-0x000000007EF61000-memory.dmp
memory/1392-221-0x0000000000400000-0x0000000000407000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-03-14 04:07
Reported
2024-03-14 04:10
Platform
win10v2004-20240226-en
Max time kernel
92s
Max time network
156s
Command Line
Signatures
Lockbit
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1408 wrote to memory of 4148 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 1408 wrote to memory of 4148 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 1408 wrote to memory of 4148 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
Files
memory/4148-0-0x0000000002A80000-0x0000000002A90000-memory.dmp
memory/4148-1-0x0000000002A80000-0x0000000002A90000-memory.dmp
memory/4148-2-0x0000000002A80000-0x0000000002A90000-memory.dmp
C:\Users\ndVkYtjAf.README.txt
| MD5 | fcf663a3d65220f447d7f71736c1da6b |
| SHA1 | a228033f688c719c77ded0eceb3600d49fc07c09 |
| SHA256 | f37d783c7a54ac8e05b17c601d28f8941ab26354c583d45a008d256d9031192b |
| SHA512 | d3eb447ca020522830a73c501794ed2af72ba25d574d987a7f104fb856c0c14dcb007da33c66526d3ae678dc6fdf6a3272fd22a08ccb663ddba15fce3fda6a9f |
memory/4148-54-0x00000000056F0000-0x0000000005700000-memory.dmp
memory/4148-55-0x00000000056F0000-0x0000000005700000-memory.dmp