Malware Analysis Report

2024-10-19 07:12

Sample ID 240506-rwvlsahg32
Target 1cf26a96c17dbab78096a376a904d334_JaffaCakes118
SHA256 8a170584ad7402c1bee5b9c0932475bce9eef45d40b0774594a8df01eb9737db
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8a170584ad7402c1bee5b9c0932475bce9eef45d40b0774594a8df01eb9737db

Threat Level: Known bad

The file 1cf26a96c17dbab78096a376a904d334_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-06 14:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-06 14:33

Reported

2024-05-06 14:35

Platform

win7-20240215-en

Max time kernel

144s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2916 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2916 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2916 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2916 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 1736 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1736 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1736 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1736 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1736 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1736 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1736 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1736 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZbPSGyp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED0D.tmp"

C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEEA3.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEEF2.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
IR 185.165.153.6:2786 tcp
IR 185.165.153.6:2786 tcp
IR 185.165.153.6:2786 tcp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
IR 185.165.153.6:2786 tcp
IR 185.165.153.6:2786 tcp

Files

memory/2916-0-0x0000000074A81000-0x0000000074A82000-memory.dmp

memory/2916-1-0x0000000074A80000-0x000000007502B000-memory.dmp

memory/2916-2-0x0000000074A80000-0x000000007502B000-memory.dmp

memory/2916-3-0x0000000074A80000-0x000000007502B000-memory.dmp

memory/2916-4-0x0000000074A80000-0x000000007502B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpED0D.tmp

MD5 7df6ac88ccba309b0d9ca60e6560a1f1
SHA1 a9133185aed710e4e6b66cb04e73f52f52db8fcf
SHA256 6045d30f30a8d5957d26cba417ee2c95343dd0a8c672cfee5299a6599894d146
SHA512 8acb6d31e1b095683ed51944398573ea353ea39e76fd4ef02b3513602d3b5e3cd36ad06e3f02995dff95642af53176d94e88351e63324ac13c528b3ec5f9c486

memory/1736-23-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1736-21-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2916-24-0x0000000074A80000-0x000000007502B000-memory.dmp

memory/1736-19-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1736-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1736-16-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1736-14-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1736-12-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1736-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1736-25-0x0000000074A80000-0x000000007502B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEEA3.tmp

MD5 35841428102cf4e6443eb6a26cb5ee25
SHA1 294ee146090b735546db5899abbeef3cd8c2c78f
SHA256 156121255aeba07e9e666ba731729e6b414385c391af58005bda5fe6406a1412
SHA512 67a5d24ca46ff3f791495a4cbe838378d4efd50219c69895f56707138e4203cb03ca51a492ed39eae3e9e207c63963d73fe220318ba6c5506122874f16744953

C:\Users\Admin\AppData\Local\Temp\tmpEEF2.tmp

MD5 8e2d5fba24ae8a54087d8e6cadc188c1
SHA1 548555025543b4773b8f36301f5fa5003e1c85dc
SHA256 f8a3739cca23897792b42a11a21adcce745201fa19f8d84ec66a6e0c5e519759
SHA512 9246583d7b08152cd73dc40254013e1ae4b8c93603dbb1f4e6b82624e14b134c59de6c8039b588f14075602768a388121e985f886322ae5fb9ec2eee94d4ea3d

memory/1736-33-0x0000000074A80000-0x000000007502B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-06 14:33

Reported

2024-05-06 14:35

Platform

win10v2004-20240419-en

Max time kernel

134s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Monitor = "C:\\Program Files (x86)\\WPA Monitor\\wpamon.exe" C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WPA Monitor\wpamon.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\WPA Monitor\wpamon.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 212 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 212 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 212 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 212 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 212 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 212 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 212 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 212 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 212 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 212 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 212 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe
PID 2804 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2804 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZbPSGyp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1E03.tmp"

C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1cf26a96c17dbab78096a376a904d334_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp20A2.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp240E.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
IR 185.165.153.6:2786 tcp
IR 185.165.153.6:2786 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
IR 185.165.153.6:2786 tcp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.8.8:53 yawalessinc.hopto.org udp
US 8.8.4.4:53 yawalessinc.hopto.org udp
IR 185.165.153.6:2786 tcp

Files

memory/212-0-0x0000000074B12000-0x0000000074B13000-memory.dmp

memory/212-1-0x0000000074B10000-0x00000000750C1000-memory.dmp

memory/212-2-0x0000000074B10000-0x00000000750C1000-memory.dmp

memory/212-3-0x0000000074B12000-0x0000000074B13000-memory.dmp

memory/212-4-0x0000000074B10000-0x00000000750C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1E03.tmp

MD5 579985e31378a37cc7fa75f044da63f5
SHA1 4dc01138db9625a29a78d30001c810f3d92631e8
SHA256 bf6e8d31d41faa0a6d3aa347f20bb02aa98f2e0ee130ccebc3618ebf44b4b255
SHA512 d9746ccbb5b06ec2e745d25b40f591df658429e87314cd78d4957ee0d0492ce78aaee6cf0627515072bb55cc95f224a3dda2790288db3e47317aca4e95621db2

memory/2804-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2804-12-0x0000000074B10000-0x00000000750C1000-memory.dmp

memory/2804-13-0x0000000074B10000-0x00000000750C1000-memory.dmp

memory/212-14-0x0000000074B10000-0x00000000750C1000-memory.dmp

memory/2804-15-0x0000000074B10000-0x00000000750C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp20A2.tmp

MD5 35841428102cf4e6443eb6a26cb5ee25
SHA1 294ee146090b735546db5899abbeef3cd8c2c78f
SHA256 156121255aeba07e9e666ba731729e6b414385c391af58005bda5fe6406a1412
SHA512 67a5d24ca46ff3f791495a4cbe838378d4efd50219c69895f56707138e4203cb03ca51a492ed39eae3e9e207c63963d73fe220318ba6c5506122874f16744953

C:\Users\Admin\AppData\Local\Temp\tmp240E.tmp

MD5 a246b3561d823177f3586e629f144233
SHA1 0f05d12e55a1d2e5e6a4f307c193882fba093315
SHA256 6abae7707b06e52b58f537b335e367cc54b093e899d78f16e94ceaf7ceafca52
SHA512 4246aa9a96331e2c7e36b37fa778e31ecae055c77164e0dc673aa50cdec368f08d356ab06ef1a4540816c474828048ab1bebed7e211a4eb929f2918e1fac9c6d

memory/2804-23-0x0000000074B10000-0x00000000750C1000-memory.dmp

memory/2804-24-0x0000000074B10000-0x00000000750C1000-memory.dmp

memory/2804-25-0x0000000074B10000-0x00000000750C1000-memory.dmp