Malware Analysis Report

2024-10-19 07:12

Sample ID 240501-3balnacb89
Target 0cd68ba9e64c68b500c04bb3300f0a0a_JaffaCakes118
SHA256 e9669d064c0d0c0f68d4c73e909625f2654567ceb936f08e00801e222635145d
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e9669d064c0d0c0f68d4c73e909625f2654567ceb936f08e00801e222635145d

Threat Level: Known bad

The file 0cd68ba9e64c68b500c04bb3300f0a0a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-01 23:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-01 23:19

Reported

2024-05-01 23:22

Platform

win7-20240221-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1500 set thread context of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A
File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1500 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 1500 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 1500 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 1500 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 1500 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 2412 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 2412 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 2412 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 2412 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 2412 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 2412 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 2412 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 2412 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe

"C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXNNIWvBZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2617.tmp"

C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe

"{path}"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2D28.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2EA0.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp

Files

memory/1500-0-0x0000000074B81000-0x0000000074B82000-memory.dmp

memory/1500-1-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/1500-2-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/1500-3-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/1500-4-0x0000000074B80000-0x000000007512B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2617.tmp

MD5 4a90bb41d05308df1f90c1e44fdc7944
SHA1 b3231213113ec46636ebd5ee618705e5d41a03e0
SHA256 558a90d56a479842ca715d0116c6789288a26c1e00ec9df8cbf3c60000270317
SHA512 0055ace5e5960889e3be54ca1c374f15e71e3bdfbedff069b0a737d30c49b01594d1f9b9c99dbb42831b9a8eb03bd838a6972e7d225496c65a0a0f50d3e10732

memory/2412-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2412-17-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2412-21-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2412-19-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2412-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2412-14-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2412-12-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2412-11-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1500-22-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2412-23-0x0000000074B80000-0x000000007512B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2D28.tmp

MD5 d4343b952f5e92c7dd0cda4158a2965b
SHA1 b34b2a0ea9ed2781da3fdad88bb60152cada238b
SHA256 e10e7f2509a207cb6036e897f69cbfab1bc15540418362d2ea61441c982b13ca
SHA512 2e60bcf166cc8ef6a7aeb9134562af0b3a0d81f3ab8bb9ec359de74a3dee51e20c0ecdde42c8c1bdf68542ece98bb17fb2dbc8ea9d3f0e4784dc473596970f27

C:\Users\Admin\AppData\Local\Temp\tmp2EA0.tmp

MD5 93d357e6194c8eb8d0616a9f592cc4bf
SHA1 5cc3a3d95d82cb88f65cb6dc6c188595fa272808
SHA256 a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713
SHA512 4df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f

memory/2412-31-0x0000000074B80000-0x000000007512B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-01 23:19

Reported

2024-05-01 23:22

Platform

win10v2004-20240419-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3704 set thread context of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A
File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3704 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 3704 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 3704 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 3704 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 3704 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 3704 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 3704 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 3704 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 3704 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 3704 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 3704 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe
PID 4284 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 4284 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 4284 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 4284 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 4284 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe
PID 4284 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe

"C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXNNIWvBZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD1C7.tmp"

C:\Users\Admin\AppData\Local\Temp\TNT AWB TRACKING DETAILS.exe

"{path}"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD63C.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD68B.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 51.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 royal2222.duckdns.org udp
HK 185.140.53.18:8804 royal2222.duckdns.org tcp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

memory/3704-0-0x0000000075332000-0x0000000075333000-memory.dmp

memory/3704-1-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/3704-2-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/3704-3-0x0000000075332000-0x0000000075333000-memory.dmp

memory/3704-4-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/3704-5-0x0000000075330000-0x00000000758E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD1C7.tmp

MD5 a87114f5028ad82250aac7a9df9d543c
SHA1 8dba7fde19dd21388deb862e88d2f058bb4e60e6
SHA256 929b9cf55578283995eb844f316570dd894ef0ea0dfc6b242598b16dcf1a180d
SHA512 6ac393b5d46adad03f807d3216075cf6b5954dabf70acfc250fa6e5db0f2039d94ee99ff0b50118b43fa6b47b1ab79660b3e5b3f412b3f93aa0cdf0c5a01b1be

memory/4284-11-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\TNT AWB TRACKING DETAILS.exe.log

MD5 7baa6583f69f63f7230df9bf98448356
SHA1 fe9eb85b57192362da704a3c130377fe83862320
SHA256 a632504621b4cac1d5ba5465c7ad9b30f3d036e9838682506782124a211bed4f
SHA512 0e72541791281c0fdac1f5fc6beea0b9eb8766b2a386aecb92cb8a44e5b59b7114c79194393ddeff957ffe86021a311caed7ce2731b863d97ad441870efbc051

memory/4284-14-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/3704-15-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/4284-16-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/4284-18-0x0000000075330000-0x00000000758E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD63C.tmp

MD5 d4343b952f5e92c7dd0cda4158a2965b
SHA1 b34b2a0ea9ed2781da3fdad88bb60152cada238b
SHA256 e10e7f2509a207cb6036e897f69cbfab1bc15540418362d2ea61441c982b13ca
SHA512 2e60bcf166cc8ef6a7aeb9134562af0b3a0d81f3ab8bb9ec359de74a3dee51e20c0ecdde42c8c1bdf68542ece98bb17fb2dbc8ea9d3f0e4784dc473596970f27

C:\Users\Admin\AppData\Local\Temp\tmpD68B.tmp

MD5 93d357e6194c8eb8d0616a9f592cc4bf
SHA1 5cc3a3d95d82cb88f65cb6dc6c188595fa272808
SHA256 a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713
SHA512 4df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f

memory/4284-25-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/4284-26-0x0000000075330000-0x00000000758E1000-memory.dmp