Malware Analysis Report

2024-08-06 15:22

Sample ID 240519-jne75ahc76
Target 595049ee2c75b23f406a9346ba07d610_JaffaCakes118
SHA256 753a7493be05ba01034f3c861ff1805a4336616e84469f40800d876dcba3381a
Tags
nanocore keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

753a7493be05ba01034f3c861ff1805a4336616e84469f40800d876dcba3381a

Threat Level: Known bad

The file 595049ee2c75b23f406a9346ba07d610_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore keylogger spyware stealer trojan

NanoCore

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-19 07:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 07:48

Reported

2024-05-19 07:51

Platform

win7-20240215-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1204 set thread context of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1204 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1204 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1204 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1204 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1204 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 2500 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe
PID 2500 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe
PID 2500 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe
PID 2500 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UZchfTEEpNCg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE80E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE9D2.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp

Files

memory/1204-0-0x0000000074B11000-0x0000000074B12000-memory.dmp

memory/1204-1-0x0000000074B10000-0x00000000750BB000-memory.dmp

memory/1204-2-0x0000000074B10000-0x00000000750BB000-memory.dmp

memory/1204-3-0x0000000074B10000-0x00000000750BB000-memory.dmp

memory/1204-4-0x0000000074B10000-0x00000000750BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE80E.tmp

MD5 d7935446b1d570ec213c0bc1e8b09d3d
SHA1 818bfec909b19237f4f080a913fe9e106ba66dcd
SHA256 26a655657fd55fcadb3c0354c362868c1c713240c75596e5bafba4d5f2928177
SHA512 2b7c13d6302f0f1a1d17f0b496011478dfa5a7462efe7d2977946a9ff5a00543778a81ec6d4f2ad22316118057da05b89619c282ef71361598223095ab065eee

memory/2500-19-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-23-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-21-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2500-16-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-14-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2500-12-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1204-24-0x0000000074B10000-0x00000000750BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE9D2.tmp

MD5 ae766004c0d8792953bafffe8f6a2e3b
SHA1 14b12f27543a401e2fe0af8052e116cab0032426
SHA256 1abdd9b6a6b84e4ba1af1282dc84ce276c59ba253f4c4af05fea498a4fd99540
SHA512 e530da4a5d4336fc37838d0e93b5eb3804b9c489c71f6954a47fc81a4c655bb72ec493e109cf96e6e3617d7623ac80697ad3bbd5ffc6281bafc8b34dca5e6567

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 07:48

Reported

2024-05-19 07:51

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1992 set thread context of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1992 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1992 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1992 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1992 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1992 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 1276 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe
PID 1276 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe
PID 1276 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\595049ee2c75b23f406a9346ba07d610_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UZchfTEEpNCg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp144E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DOS Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1AB7.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.8.8:53 hustlerman.ddns.net udp
US 8.8.4.4:53 hustlerman.ddns.net udp

Files

memory/1992-0-0x0000000074F82000-0x0000000074F83000-memory.dmp

memory/1992-1-0x0000000074F80000-0x0000000075531000-memory.dmp

memory/1992-2-0x0000000074F80000-0x0000000075531000-memory.dmp

memory/1992-3-0x0000000074F82000-0x0000000074F83000-memory.dmp

memory/1992-4-0x0000000074F80000-0x0000000075531000-memory.dmp

memory/1992-5-0x0000000074F80000-0x0000000075531000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp144E.tmp

MD5 9ef6803ca1c8ffc067588afdb5455368
SHA1 ab084740bdfe7f53bc7a584a793a013f02d49813
SHA256 115611378ffe9e2f3f866e99fa015ecf0a7fea5869e9071fe4e1fda2db1c5726
SHA512 ec0f2c06ec00d755f2ccd421c00691fe3a6c9ebb0f44183ed94255d1f9bc244d7ce1bd059e559a0257a9e8d1b5722feeb0808a35022e1b455e85169ab89e40c8

memory/1276-11-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1276-13-0x0000000074F80000-0x0000000075531000-memory.dmp

memory/1992-14-0x0000000074F80000-0x0000000075531000-memory.dmp

memory/1276-15-0x0000000074F80000-0x0000000075531000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1AB7.tmp

MD5 ae766004c0d8792953bafffe8f6a2e3b
SHA1 14b12f27543a401e2fe0af8052e116cab0032426
SHA256 1abdd9b6a6b84e4ba1af1282dc84ce276c59ba253f4c4af05fea498a4fd99540
SHA512 e530da4a5d4336fc37838d0e93b5eb3804b9c489c71f6954a47fc81a4c655bb72ec493e109cf96e6e3617d7623ac80697ad3bbd5ffc6281bafc8b34dca5e6567

memory/1276-20-0x0000000074F80000-0x0000000075531000-memory.dmp

memory/1276-21-0x0000000074F80000-0x0000000075531000-memory.dmp

memory/1276-22-0x0000000074F80000-0x0000000075531000-memory.dmp