Malware Analysis Report

2025-03-15 06:02

Sample ID 240512-fe5vmshc7t
Target dfafa5973faa0e79ebacfad3f388da56732c08966e273deb99ed986f6b561f0d
SHA256 dfafa5973faa0e79ebacfad3f388da56732c08966e273deb99ed986f6b561f0d
Tags
vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dfafa5973faa0e79ebacfad3f388da56732c08966e273deb99ed986f6b561f0d

Threat Level: Known bad

The file dfafa5973faa0e79ebacfad3f388da56732c08966e273deb99ed986f6b561f0d was found to be: Known bad.

Malicious Activity Summary

vmprotect

Detects Reflective DLL injection artifacts

Detects executables packed with VMProtect.

Detects Reflective DLL injection artifacts

Detects executables packed with VMProtect.

VMProtect packed file

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-12 04:48

Signatures

Detects Reflective DLL injection artifacts

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables packed with VMProtect.

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-12 04:48

Reported

2024-05-12 04:50

Platform

win7-20231129-en

Max time kernel

150s

Max time network

144s

Command Line

C:\Windows\system32\svchost.exe -k netsvcs

Signatures

Detects Reflective DLL injection artifacts

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with VMProtect.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1380 set thread context of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mac.txt C:\Windows\SysWOW64\cliconfg.exe N/A
File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf C:\Windows\system32\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\cliconfg.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2884 wrote to memory of 2956 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2884 wrote to memory of 2956 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2884 wrote to memory of 2956 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2884 wrote to memory of 2956 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2884 wrote to memory of 2956 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2884 wrote to memory of 2956 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2884 wrote to memory of 2956 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2956 wrote to memory of 852 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2956 wrote to memory of 852 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2956 wrote to memory of 852 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2956 wrote to memory of 852 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2956 wrote to memory of 852 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2956 wrote to memory of 852 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2956 wrote to memory of 852 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2956 wrote to memory of 852 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2956 wrote to memory of 1380 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Explorer.EXE
PID 2956 wrote to memory of 1380 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Explorer.EXE
PID 2956 wrote to memory of 1380 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Explorer.EXE
PID 2956 wrote to memory of 1380 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Explorer.EXE
PID 1380 wrote to memory of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe
PID 1380 wrote to memory of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe
PID 1380 wrote to memory of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe
PID 1380 wrote to memory of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe
PID 1380 wrote to memory of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe
PID 1380 wrote to memory of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe
PID 1380 wrote to memory of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe
PID 1380 wrote to memory of 2624 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cliconfg.exe
PID 852 wrote to memory of 2804 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 852 wrote to memory of 2804 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE
PID 852 wrote to memory of 2804 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\WMIADAP.EXE

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfafa5973faa0e79ebacfad3f388da56732c08966e273deb99ed986f6b561f0d.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfafa5973faa0e79ebacfad3f388da56732c08966e273deb99ed986f6b561f0d.dll,#1

C:\Windows\SysWOW64\cliconfg.exe

C:\Windows\SysWOW64\cliconfg.exe

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.5566331.com udp
HK 47.76.217.234:80 api.5566331.com tcp
N/A 255.255.255.255:23779 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56297 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56298 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56299 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56300 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56301 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56302 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56303 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56304 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56305 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56306 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56307 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56308 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56309 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56310 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56311 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56312 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56313 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56314 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.71:56315 udp

Files

memory/852-0-0x00000000012B0000-0x00000000013B6000-memory.dmp

memory/852-3-0x00000000012B0000-0x00000000013B6000-memory.dmp

memory/1380-16-0x00000000051E0000-0x00000000052E6000-memory.dmp

memory/1380-18-0x00000000051E0000-0x00000000052E6000-memory.dmp

memory/1380-26-0x0000000180000000-0x00000001800FB000-memory.dmp

memory/1380-20-0x0000000180000000-0x00000001800FB000-memory.dmp

memory/1380-17-0x00000000051E0000-0x00000000052E6000-memory.dmp

memory/852-11-0x00000000027F0000-0x00000000028F6000-memory.dmp

memory/852-9-0x00000000027F0000-0x00000000028F6000-memory.dmp

memory/852-10-0x00000000027F0000-0x00000000028F6000-memory.dmp

memory/852-4-0x00000000012B0000-0x00000000013B6000-memory.dmp

memory/852-2-0x00000000012B0000-0x00000000013B6000-memory.dmp

memory/852-1-0x00000000012B0000-0x00000000013B6000-memory.dmp

memory/2624-36-0x0000000000080000-0x0000000000158000-memory.dmp

memory/2624-34-0x0000000000080000-0x0000000000158000-memory.dmp

memory/2624-33-0x0000000000080000-0x0000000000158000-memory.dmp

memory/2624-38-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/2624-30-0x0000000000080000-0x0000000000158000-memory.dmp

memory/2624-29-0x0000000000080000-0x0000000000158000-memory.dmp

memory/2624-47-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/2624-50-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/2624-52-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/2624-51-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/2624-61-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/2624-60-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/2624-62-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/2624-63-0x0000000010000000-0x00000000102E7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-12 04:48

Reported

2024-05-12 04:50

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

Signatures

Detects Reflective DLL injection artifacts

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with VMProtect.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2652 set thread context of 6088 N/A C:\Windows\system32\svchost.exe C:\Windows\SysWOW64\cleanmgr.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mac.txt C:\Windows\SysWOW64\cleanmgr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\cleanmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4500 wrote to memory of 3500 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4500 wrote to memory of 3500 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4500 wrote to memory of 3500 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3500 wrote to memory of 2652 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 3500 wrote to memory of 2652 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 3500 wrote to memory of 2652 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 3500 wrote to memory of 2652 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\svchost.exe
PID 2652 wrote to memory of 6088 N/A C:\Windows\system32\svchost.exe C:\Windows\SysWOW64\cleanmgr.exe
PID 2652 wrote to memory of 6088 N/A C:\Windows\system32\svchost.exe C:\Windows\SysWOW64\cleanmgr.exe
PID 2652 wrote to memory of 6088 N/A C:\Windows\system32\svchost.exe C:\Windows\SysWOW64\cleanmgr.exe
PID 2652 wrote to memory of 6088 N/A C:\Windows\system32\svchost.exe C:\Windows\SysWOW64\cleanmgr.exe
PID 2652 wrote to memory of 6088 N/A C:\Windows\system32\svchost.exe C:\Windows\SysWOW64\cleanmgr.exe
PID 2652 wrote to memory of 6088 N/A C:\Windows\system32\svchost.exe C:\Windows\SysWOW64\cleanmgr.exe
PID 2652 wrote to memory of 6088 N/A C:\Windows\system32\svchost.exe C:\Windows\SysWOW64\cleanmgr.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfafa5973faa0e79ebacfad3f388da56732c08966e273deb99ed986f6b561f0d.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfafa5973faa0e79ebacfad3f388da56732c08966e273deb99ed986f6b561f0d.dll,#1

C:\Windows\SysWOW64\cleanmgr.exe

C:\Windows\SysWOW64\cleanmgr.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.5566331.com udp
HK 47.76.217.234:80 api.5566331.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 234.217.76.47.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
N/A 255.255.255.255:23779 udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:53042 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:53043 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:53044 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:53045 udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:63736 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:63737 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:63738 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:63739 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:57752 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:57753 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:57754 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:57755 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:57756 udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:62766 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:62767 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:62768 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:62769 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:62770 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:62771 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:62772 udp
N/A 255.255.255.255:23881 udp
N/A 10.127.0.110:62773 udp

Files

memory/2652-0-0x0000000026670000-0x0000000026776000-memory.dmp

memory/2652-8-0x0000000180000000-0x00000001800FB000-memory.dmp

memory/2652-2-0x0000000180000000-0x00000001800FB000-memory.dmp

memory/6088-10-0x0000000001000000-0x00000000010D8000-memory.dmp

memory/6088-13-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/6088-20-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/6088-24-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/6088-26-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/6088-25-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/6088-28-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/6088-27-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/6088-29-0x0000000010000000-0x00000000102E7000-memory.dmp

memory/6088-30-0x0000000010000000-0x00000000102E7000-memory.dmp