Malware Analysis Report

2024-10-23 19:44

Sample ID 240426-jnnt9sca81
Target 004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118
SHA256 8c7d7b57c53c0a217d1c8cb3a75bcc499bf709d81931d20c85332aeeac776e15
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c7d7b57c53c0a217d1c8cb3a75bcc499bf709d81931d20c85332aeeac776e15

Threat Level: Known bad

The file 004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

AutoIT Executable

Drops file in Program Files directory

Unsigned PE

Suspicious use of FindShellTrayWindow

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-26 07:49

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-26 07:49

Reported

2024-04-26 07:51

Platform

win7-20240221-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Host = "C:\\Program Files (x86)\\DHCP Host\\dhcphost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2884 set thread context of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DHCP Host\dhcphost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\DHCP Host\dhcphost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2884 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2832 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp120A.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp12A7.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp

Files

memory/2884-0-0x0000000001050000-0x0000000001083000-memory.dmp

memory/2884-1-0x00000000005F0000-0x00000000005F1000-memory.dmp

memory/2832-2-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2832-3-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2832-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2832-9-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2832-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2832-11-0x0000000074130000-0x00000000746DB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp120A.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

C:\Users\Admin\AppData\Local\Temp\tmp12A7.tmp

MD5 0479d5f304ef2d7e3c15fb24a99f88c1
SHA1 8edbb1450a656fac5f5e96779ffe440ee8c1aec9
SHA256 112557c2b2d0c669a3b115129dc32f005341e965330fa8f2ad3e5de1926594bc
SHA512 537e8d87e5cd975f0e69bb145f81d6e9d7b0d82eed143ac351304ea38577137386a51fdb7357ec6d641eb04ff5f51e249bba2db8a4b5bf2934d561394a4a3f15

memory/2832-19-0x00000000008E0000-0x0000000000920000-memory.dmp

memory/2832-20-0x0000000074130000-0x00000000746DB000-memory.dmp

memory/2832-21-0x00000000008E0000-0x0000000000920000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-26 07:49

Reported

2024-04-26 07:51

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3496 set thread context of 4844 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3496 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3496 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3496 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3496 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3496 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4844 wrote to memory of 4748 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 4844 wrote to memory of 4748 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 4844 wrote to memory of 4748 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 4844 wrote to memory of 4792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 4844 wrote to memory of 4792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 4844 wrote to memory of 4792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\004f7dbf5fb799c4f078c3f0832b19b7_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp61C7.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6216.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 25.69.169.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 67.32.209.4.in-addr.arpa udp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 153.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 198.32.209.4.in-addr.arpa udp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 craftedfollowing.duckdns.org udp
US 192.169.69.25:5654 craftedfollowing.duckdns.org tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp
US 8.8.8.8:53 sandshoe.ignorelist.com udp
N/A 127.0.0.2:5654 tcp

Files

memory/3496-0-0x0000000001470000-0x00000000014A3000-memory.dmp

memory/3496-1-0x00000000014B0000-0x00000000014B1000-memory.dmp

memory/4844-2-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4844-7-0x0000000075180000-0x0000000075731000-memory.dmp

memory/4844-8-0x0000000001480000-0x0000000001490000-memory.dmp

memory/4844-9-0x0000000075180000-0x0000000075731000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp61C7.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

C:\Users\Admin\AppData\Local\Temp\tmp6216.tmp

MD5 93d357e6194c8eb8d0616a9f592cc4bf
SHA1 5cc3a3d95d82cb88f65cb6dc6c188595fa272808
SHA256 a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713
SHA512 4df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f

memory/4844-17-0x0000000075180000-0x0000000075731000-memory.dmp

memory/4844-18-0x0000000001480000-0x0000000001490000-memory.dmp