Analysis Overview
SHA256
2d952fedf846b7d19e3e75632fa03826b6da922ba04c308283c5ce8110a5e456
Threat Level: Shows suspicious behavior
The file Lunar.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Unsigned PE
Detects Pyinstaller
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Modifies registry class
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-25 22:45
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-25 22:45
Reported
2024-05-25 22:48
Platform
win7-20240220-en
Max time kernel
128s
Max time network
141s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Lunar.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"
C:\Users\Admin\AppData\Local\Temp\Lunar.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6539758,0x7fef6539768,0x7fef6539778
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1548 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1248 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3020 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3580 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3536 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2484 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2372 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2248 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3864 --field-trial-handle=1372,i,653431686851645439,12334374029810597453,131072 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 142.250.179.238:443 | play.google.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.196:443 | www.google.com | udp |
| US | 8.8.8.8:53 | i.ytimg.com | udp |
| GB | 142.250.200.54:443 | i.ytimg.com | tcp |
| GB | 142.250.200.54:443 | i.ytimg.com | tcp |
| GB | 142.250.200.54:443 | i.ytimg.com | tcp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| GB | 142.250.187.202:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | www.youtube.com | udp |
| GB | 142.250.179.238:443 | www.youtube.com | udp |
| GB | 142.250.200.54:443 | i.ytimg.com | udp |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | static.doubleclick.net | udp |
| GB | 172.217.169.34:443 | googleads.g.doubleclick.net | tcp |
| US | 8.8.8.8:53 | jnn-pa.googleapis.com | udp |
| GB | 216.58.213.6:443 | static.doubleclick.net | tcp |
| GB | 172.217.16.234:443 | jnn-pa.googleapis.com | udp |
| GB | 172.217.169.34:443 | googleads.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | www.python.org | udp |
| GB | 146.75.72.223:443 | www.python.org | tcp |
| GB | 146.75.72.223:443 | www.python.org | tcp |
| GB | 216.58.212.195:80 | www.gstatic.com | tcp |
| GB | 146.75.72.223:443 | www.python.org | tcp |
| GB | 146.75.72.223:443 | www.python.org | tcp |
| GB | 146.75.72.223:443 | www.python.org | tcp |
| US | 8.8.8.8:53 | media.ethicalads.io | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 216.58.204.74:443 | ajax.googleapis.com | tcp |
| US | 172.67.71.230:443 | media.ethicalads.io | tcp |
| GB | 216.58.204.74:443 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | ssl.google-analytics.com | udp |
| GB | 142.250.187.232:443 | ssl.google-analytics.com | tcp |
| US | 8.8.8.8:53 | console.python.org | udp |
| US | 8.8.8.8:53 | 2p66nmmycsj3.statuspage.io | udp |
| US | 167.99.21.118:443 | console.python.org | tcp |
| GB | 142.250.187.232:443 | ssl.google-analytics.com | udp |
| US | 3.162.140.62:443 | 2p66nmmycsj3.statuspage.io | tcp |
| US | 8.8.8.8:53 | stats.g.doubleclick.net | udp |
| BE | 64.233.166.154:443 | stats.g.doubleclick.net | tcp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| US | 192.178.49.195:443 | beacons.gcp.gvt2.com | tcp |
| US | 192.178.49.195:443 | beacons.gcp.gvt2.com | tcp |
| US | 192.178.49.195:443 | beacons.gcp.gvt2.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI17322\ucrtbase.dll
| MD5 | 0e0bac3d1dcc1833eae4e3e4cf83c4ef |
| SHA1 | 4189f4459c54e69c6d3155a82524bda7549a75a6 |
| SHA256 | 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae |
| SHA512 | a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd |
C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 3589557535bba7641da3d76eefb0c73d |
| SHA1 | 6f63107c2212300c7cd1573059c08b43e5bd9b95 |
| SHA256 | 642b01bb93d2cb529acf56070d65aae3202fd0b48d19fd40ec6763b627bcbee6 |
| SHA512 | 7aedf3cf686b416f8b419f8af1d57675096ab2c2378c5a006f6ecbf2fe1ad701f28b7be8f08c9083230cf4d15d463371e92a6032178cd6c139d60b26fbd49b06 |
C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 774aa9f9318880cb4ad3bf6f464da556 |
| SHA1 | 3a5c07cf35009c98eb033e1cbde1900135d1abf8 |
| SHA256 | ba9fbd3a21879614c050c86a74ad2fffc0362266d6fa7be0ef359de393136346 |
| SHA512 | f7b57afb9810e3390d27a5469572fb29f0f1726f599403a180e685466237dff5dec4fdce40105ef1bb057e012d546308213e7cec73e0d7d3c5815eec8189a75d |
C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-file-l1-2-0.dll
| MD5 | 2b36752a5157359da1c0e646ee9bec45 |
| SHA1 | 708aeb7e945c9c709109cea359cb31bd7ac64889 |
| SHA256 | 3e3eb284937b572d1d70ce27be77b5e02eb73704c8b50feb5eb933db1facd2fc |
| SHA512 | fc56080362506e3f38f1b3eb9d3193cdb9e576613c2e672f0fe9df203862f8a0f31938fa48b4ff7115dfe6016fa1fd5c5422fdc1913df63b3fde5f478a8417a1 |
C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | b9a20c9223d3e3d3a0c359f001ce1046 |
| SHA1 | 9710b9a8c393ba00c254cf693c7c37990c447cc8 |
| SHA256 | 00d9a7353be0a54c17e4862b86196a8b2bc6a007899fa2fbe61afd9765548068 |
| SHA512 | a7d5611c0b3b53da6cac61e0374d54d27e6e8a1af90ef66cd7e1b052f906c8b3f6087f4c6de0db3ae0b099df7689ecde6c815a954b728d36d9d3b5d002ccf18e |
C:\Users\Admin\AppData\Local\Temp\_MEI17322\api-ms-win-core-file-l2-1-0.dll
| MD5 | bfffa7117fd9b1622c66d949bac3f1d7 |
| SHA1 | 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2 |
| SHA256 | 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e |
| SHA512 | b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f |
C:\Users\Admin\AppData\Local\Temp\_MEI17322\python311.dll
| MD5 | 387bb2c1e40bde1517f06b46313766be |
| SHA1 | 601f83ef61c7699652dec17edd5a45d6c20786c4 |
| SHA256 | 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364 |
| SHA512 | 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad |
\??\pipe\crashpad_2792_DADAXWMJBNRKEOQT
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
| MD5 | 18e723571b00fb1694a3bad6c78e4054 |
| SHA1 | afcc0ef32d46fe59e0483f9a3c891d3034d12f32 |
| SHA256 | 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa |
| SHA512 | 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
| MD5 | f50f89a0a91564d0b8a211f8921aa7de |
| SHA1 | 112403a17dd69d5b9018b8cede023cb3b54eab7d |
| SHA256 | b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec |
| SHA512 | bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
| MD5 | aefd77f47fb84fae5ea194496b44c67a |
| SHA1 | dcfbb6a5b8d05662c4858664f81693bb7f803b82 |
| SHA256 | 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611 |
| SHA512 | b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RFf769972.TMP
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\Tar9F24.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | b48a06754280e640041b83772b281fcd |
| SHA1 | e2d55fd887a6a6f3c78230ca4a676dc261d3a725 |
| SHA256 | 060cdb38f129cd7154ed026d24556d528d7846293529e74ab559e3e994f7e79e |
| SHA512 | 29b79f3053ffb298c04928a20aa851808e346cd08b85640c3fc1e48921bc52fc73e289bfeb717fb4c1fa3ee8d26a3d5bd929b433e50f914087579ddb713a7833 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 5d8d37b86feaf990ee6a78947672110c |
| SHA1 | b4d86064a758c4f7ce6836dad523ea2085a84fca |
| SHA256 | f9ab1dd54cf60c7551dd2a7dce1103ff584699d8bbeae2adc6561037bc4f9e94 |
| SHA512 | ca7e44a7b79a90df7616a49bea48415f643132369b207377b93b5b00ebb4d6cebfb60ae76775f52623d91ebda9fadf2add29cc3ab1efe1ccca17ae764e27e012 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fb37f6b21ec30fbf1cb6d78882106271 |
| SHA1 | 917c28761390e22d540650e850163ce65855290e |
| SHA256 | aca19d542b048742345ca042c954492cb1286ac8718c555ed3157609fcba2fdf |
| SHA512 | 7ca2ff460e52d322e837e44febc6514e18c663c719afe44872779e51378b8a73229850cca79e33c44d17be1c02404b8df1414332fdf720af7c7bb24358d8c32e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 6167ca0c50b655003afebb7963167c26 |
| SHA1 | 514e224fc5757597feda19e39cf786f0e6f3070c |
| SHA256 | 53adca75c3df9dbb352310d162fdaef18d4258a2a27f9add24e82c8ffea178c5 |
| SHA512 | 46d999d55e9c5565e05e5706b0ca90480b486932fa225b5e7429c8a2f93e34a87dccd1e73d3ddcde32cb5fdb20343f16608e188947e03276ec5828b60d4ba442 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ba83dc64b4731e60b32eaf4b4febc3e9 |
| SHA1 | 7ece2f98ce5cf23f3761d45f1ca58587ec6a0e4a |
| SHA256 | d0c187cbab3ef367c99f86f0004e553ea9a998a718d6762c305bfadcdffa6905 |
| SHA512 | 3804b784e1f181647802bbf02e26420132001c43b2e9598f1969c3a4e46c20e74a6db13fc00ef7b0f08f1b0e2eae5ebce77743f8fbb79ad138718c59ba28fb78 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 01ff4e7541f78c4959fd22dba5f2e119 |
| SHA1 | 48a5ccaaaf001c705cfb8b888a9b0c86221f82ae |
| SHA256 | 2f07c6c8d3ec5a03f43d4f3c10e3f973ae10bab3c9c9e1a2544032862e4b9824 |
| SHA512 | fac837c797b7ca7c5b1ad472d440dee64883cfcc218add94abe97712d75ae74f2d8afe6ca74fcea3e4f374b6cf679d1f9b8ca39c3be421f5149eeede112a17a5 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-25 22:45
Reported
2024-05-25 22:48
Platform
win10v2004-20240426-en
Max time kernel
150s
Max time network
151s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3592 wrote to memory of 1416 | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | C:\Users\Admin\AppData\Local\Temp\Lunar.exe |
| PID 3592 wrote to memory of 1416 | N/A | C:\Users\Admin\AppData\Local\Temp\Lunar.exe | C:\Users\Admin\AppData\Local\Temp\Lunar.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Lunar.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"
C:\Users\Admin\AppData\Local\Temp\Lunar.exe
"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"
C:\Windows\explorer.exe
explorer.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 24.73.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI35922\ucrtbase.dll
| MD5 | 0e0bac3d1dcc1833eae4e3e4cf83c4ef |
| SHA1 | 4189f4459c54e69c6d3155a82524bda7549a75a6 |
| SHA256 | 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae |
| SHA512 | a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\python311.dll
| MD5 | 387bb2c1e40bde1517f06b46313766be |
| SHA1 | 601f83ef61c7699652dec17edd5a45d6c20786c4 |
| SHA256 | 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364 |
| SHA512 | 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\VCRUNTIME140.dll
| MD5 | be8dbe2dc77ebe7f88f910c61aec691a |
| SHA1 | a19f08bb2b1c1de5bb61daf9f2304531321e0e40 |
| SHA256 | 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83 |
| SHA512 | 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\_ctypes.pyd
| MD5 | 565d011ce1cee4d48e722c7421300090 |
| SHA1 | 9dc300e04e5e0075de4c0205be2e8aae2064ae19 |
| SHA256 | c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7 |
| SHA512 | 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\_socket.pyd
| MD5 | b77017baa2004833ef3847a3a3141280 |
| SHA1 | 39666f74bd076015b376fc81250dff89dff4b0a6 |
| SHA256 | a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166 |
| SHA512 | 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\_bz2.pyd
| MD5 | aa1083bde6d21cabfc630a18f51b1926 |
| SHA1 | e40e61dba19301817a48fd66ceeaade79a934389 |
| SHA256 | 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3 |
| SHA512 | 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\select.pyd
| MD5 | e4ab524f78a4cf31099b43b35d2faec3 |
| SHA1 | a9702669ef49b3a043ca5550383826d075167291 |
| SHA256 | bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90 |
| SHA512 | 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\_lzma.pyd
| MD5 | b86b9f292af12006187ebe6c606a377d |
| SHA1 | 604224e12514c21ab6db4c285365b0996c7f2139 |
| SHA256 | f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5 |
| SHA512 | d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\_hashlib.pyd
| MD5 | b4ff25b1aca23d48897fc616e102e9b6 |
| SHA1 | 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2 |
| SHA256 | 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766 |
| SHA512 | a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\_decimal.pyd
| MD5 | c88282908ba54510eda3887c488198eb |
| SHA1 | 94ed1b44f99642b689f5f3824d2e490252936899 |
| SHA256 | 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278 |
| SHA512 | 312b081a90a275465787a539e48412d07f1a4c32bab0f3aa024e6e3fe534ac9c07595238d51dc4d6f13c8d03c2441f788dff9fe3d7ca2aad3940609501d273bd |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\VCRUNTIME140_1.dll
| MD5 | f8dfa78045620cf8a732e67d1b1eb53d |
| SHA1 | ff9a604d8c99405bfdbbf4295825d3fcbc792704 |
| SHA256 | a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5 |
| SHA512 | ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\unicodedata.pyd
| MD5 | fd9132f966ee6d214e0076bf0492fb30 |
| SHA1 | 89b95957f002bf382435d015e26962a42032cb97 |
| SHA256 | 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02 |
| SHA512 | e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\libcrypto-3.dll
| MD5 | e547cf6d296a88f5b1c352c116df7c0c |
| SHA1 | cafa14e0367f7c13ad140fd556f10f320a039783 |
| SHA256 | 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de |
| SHA512 | 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-utility-l1-1-0.dll
| MD5 | 57d3ee548db3a503ac391af798e0e2a2 |
| SHA1 | d686a96c5046d6d7a022c4266a5d0014745360a4 |
| SHA256 | 2c80280e51c242466e10a36a0bf2a341607983b6f6648f93b0718b34ab5285c5 |
| SHA512 | f3ea9c8f2f230d23bc878e37044599b2c77f0bf6dd84b07c2f87a84263fb9ac7f44732f05e14781b6046afb2a39f27135c96d2da2ab9605bd00e55d9b0fffb0b |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-time-l1-1-0.dll
| MD5 | 816a8932759bdb478d4263cacbf972e3 |
| SHA1 | ac9f2bed41e340313501aa7d33dcd369748f0496 |
| SHA256 | ce9a8e18923d12e2f62ce2a20693113000fc361cc816773037c155c273b99e7c |
| SHA512 | 5144f01bee04455d5b9a7b07e62f4afb928605331213eb483265016640198c175dc08673903ed5bc16b385ee76657aa4303776233d04347d9d1daadce39525c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-string-l1-1-0.dll
| MD5 | f9297b9ff06295bc07b7e5281b1face0 |
| SHA1 | d0eb0fddbb3eb187df0f0e5f9ddffcfc2e05f9b7 |
| SHA256 | c56a2ee0cc6dc1e7283b9bda8b7b2dba957329cb4bc9aca4cd99f88e108f9c04 |
| SHA512 | bec6222776015996eba744698d3254945dfe4bb4dc0d85528ee59a0f3b5fc5bb054bbf496d562cfc7b4cc81b4d3df5c53761931162a0091a49386233afba4f9c |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-stdio-l1-1-0.dll
| MD5 | 8341f0371e25b8077fe61c89a9ef8144 |
| SHA1 | fc185203e33abed12e1398440cb2ee283ca9541a |
| SHA256 | bd9a5d4554ef1a374257e8dd9436d89f686006ed1fd1cc44364b237bf5b795ff |
| SHA512 | 9c7e4e8d8e9e620f441ab5106820ec021d2b2323f44ed8cc8ec9673745dbc531347356f1ff195d63b62b09cc5c27e8f8641ce25be12ee9b700b5fc766337228b |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-runtime-l1-1-0.dll
| MD5 | 364bc49cc7034f8a9981ade1ce565229 |
| SHA1 | fbd76c1842d1ccf563ece2db32fff4c71e7ca689 |
| SHA256 | 6254fd07ace88685112e3a7b73676aabf13a1b1bc30c55dd976b34fea12b7f1d |
| SHA512 | 65e59e3358eb1bf26823c9538c74d343e7383591c021d2b340ef68aa9a274d65b15b30bbbe55f4b32e3a08fc79d4e179a6ce92eadb8c4be09a2c35c348ce10af |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-process-l1-1-0.dll
| MD5 | e3914d51afd864a6c6587aa9192c491b |
| SHA1 | bae85701809bc259a8744aafa45cd7159e6c13f8 |
| SHA256 | 28257cc063431f78284335ce3002ffb71b75c1e7ccabf5417bb42392c35564b4 |
| SHA512 | 43b1445a80d309ec73d52d6cf68f4533a132fb55ab672e5e2a878bb42c1cb36d6e4c504d43fa4923e692c8be600f3f9d5a5edde80602636cb726eedfca23dfb8 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-math-l1-1-0.dll
| MD5 | a592d1b2ecc42d1a083f0d34feae2444 |
| SHA1 | 29718af390f832626fcdcc57c107333cdb5743e1 |
| SHA256 | 18a827b01de7b1a3d5c8d17b79ad2462a90308124448a9b8c47eccda39c3a095 |
| SHA512 | 44bed6d24f1fa35b10d2b2b1574e7baf10182e60fdcb6cba5dd9de5cd7a5183198925e4fa5a7e2896564a30f7b70de69691713118d59bf5162ce35aff5bcf7a6 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-locale-l1-1-0.dll
| MD5 | 75f1a5f65790560d9544f3fb70efba51 |
| SHA1 | f30a5751901cfffc250be76e13a8b711ebc06bcc |
| SHA256 | e0e02ea6c17da186e25e352b78c80b1b3511b5c1590e5ba647b14a7b384af0f8 |
| SHA512 | b7e285ca35f6a8ae2ccbe21594d72152175301a02ad6b92fe130e1e226a0faad1bfad1bd49857401549c09b50feee2c42c23ca4c19b2845cad090f5b9e8e8f63 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-heap-l1-1-0.dll
| MD5 | 4b038cdc70357d2dec440717ac344a52 |
| SHA1 | f67ba87f6830858845a5763381a47893af061bf8 |
| SHA256 | 6a24e9cfb0efd9e1b90053d4ebd87fc35144e61ae3f6555c7d400542d648e2b5 |
| SHA512 | 9557f15fa3c06de89ea8be0c959b94575a1c4587151687730f9e66fed095feb882d43ea32262000f871e6d860ce0c6c341cf5509a6ce81866f6d0efacb8526fe |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-filesystem-l1-1-0.dll
| MD5 | 102a8c01049ef18cc6e8798a9e5d57f4 |
| SHA1 | 9adef547e03032d8c5525cc9c7d4512fbeb53948 |
| SHA256 | e13edab280e7b3410d7f4ce30a8e8cae64f38652d770fc3bf223206f0c57aaa5 |
| SHA512 | a9fbc726f33399f55f70967f3f1bf374589eaad9581d9e94228d39afa06cdce31ed25bdc04805aad361c7cafbeb56ca39f6693259d67457199d4423a61b32263 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-environment-l1-1-0.dll
| MD5 | e41612752a7dfbbe756322cf48e106b9 |
| SHA1 | 0ec106e926c9837a43e1d7ec8d1a5f03edd5ec3d |
| SHA256 | 4bb9d36e0e034652f2331ddb43ee061608f436cbc9e5771b4d27b28fa10f5248 |
| SHA512 | 9bed9399e896d1cc58cc06e8d7ec6cc3345be6d15ca307c670e0f282c9ebe48a6cc1b145c2ecf94d84214cddff8f0d0d720ea984478c74c98e2499c2184638c9 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-convert-l1-1-0.dll
| MD5 | 87e2934e49d7d111f383673f97d5029e |
| SHA1 | 267603d5510b775de3667f7d92bfaa3bd60e6533 |
| SHA256 | fb9dd774b25ab8e661c922caffb976c37a4d10a631ab65665da60016ef0c4d7c |
| SHA512 | e6025ad419359ad3e06cc7a3b3b7436464dbbc71b91653833575264a5f8b0d781844a411bcd915d404b9a8c0a056eaf6d4d412723936845b53bfb5368bf5f7a7 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-crt-conio-l1-1-0.dll
| MD5 | 9eb2c06decaae1a109a94886a26eec25 |
| SHA1 | 307ce096bee44f54a6d37aab1ef123fb423ed028 |
| SHA256 | da8fd2fe08a531d2331c1fbee9f4ae9015b64f24a2654a7f82418c86b4ab6909 |
| SHA512 | 7e701cb00a4cab8d5b3ecf55a16fef0103f9be1aa3fd7b53c7bab968708c21e8d1c763ad80a7a8d6c76dd45ddd244c9c9e8944455c2025b4195660b61ac1e8b7 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-util-l1-1-0.dll
| MD5 | f7fdc91ac711a9bb3391901957a25cea |
| SHA1 | 1cebc5497e15051249c951677b5b550a1770c24f |
| SHA256 | de47c1f924dc12e41d3a123b7dcce0260e7758b90fb95ec95c270fc116fc7599 |
| SHA512 | 0e03c998622d6bf113e8d3b4dab728974391efecf59df89f938bd22240488e71885c05fb0fa805948b3d9645758409a0966299b26625aa36e3fd6e519ee22769 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | b9a20c9223d3e3d3a0c359f001ce1046 |
| SHA1 | 9710b9a8c393ba00c254cf693c7c37990c447cc8 |
| SHA256 | 00d9a7353be0a54c17e4862b86196a8b2bc6a007899fa2fbe61afd9765548068 |
| SHA512 | a7d5611c0b3b53da6cac61e0374d54d27e6e8a1af90ef66cd7e1b052f906c8b3f6087f4c6de0db3ae0b099df7689ecde6c815a954b728d36d9d3b5d002ccf18e |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-sysinfo-l1-1-0.dll
| MD5 | e4893842d031b98cac1c6f754a2a3f8d |
| SHA1 | 2b0187134e40d27553a85dd4ec89dd6c40e58a24 |
| SHA256 | abe4c1464b325365d38e0bc4ae729a17a7f6f7ba482935c66e6840e1b0d126c5 |
| SHA512 | fc61a66fdc7213857f204bd0b20671db7092e0010e07b5e0e8e8408ace8ac5b6e696a7d9fc969233b2b3ad5dae4d3b291b007ff27a316e7fb750bfc93257c532 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-synch-l1-2-0.dll
| MD5 | b962237df7ea045c325e7f97938097cb |
| SHA1 | 1115e0e13ecc177d057e3d1c9644ac4d108f780a |
| SHA256 | a24dd6afdb4c4aa450ae4bc6a2861a49032170661b9c1f30cd0460c5dc57e0f7 |
| SHA512 | 19ac4cccaaa59fbae042d03ba52d89f309bd2591b035f3ec3df430ff399d650fcf9c4d897834a520dea60dc0562a8a6f7d25a1fffcd32f765a4eaffe4c7d5ea2 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-synch-l1-1-0.dll
| MD5 | bccc676f2fb18c1a1864363e5a649a88 |
| SHA1 | a095a83a32a4a65fe16aa0be9a517239fac5db0d |
| SHA256 | 9d3f803dc791d2ff2e05059f9bb9207cc8f4134e1ac05f20edd20cfadd6e72c0 |
| SHA512 | 55aab9fa6f7c4904e4beea4ce250f45fb71c2dd6a6f099f4017101ebc45c0a6e303b6a222f49c971992cafe8988a042b7ef8e94671be858c926105021514737a |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-string-l1-1-0.dll
| MD5 | b65933f7bcadc7072d5a2d70ecba9f81 |
| SHA1 | c53561755b9f33d0ae7874b3a7d67bedcb0129d8 |
| SHA256 | eadf535795df58d4f52fc6237fe46feb0f8166daca5eaaa59cec3cee50a9181d |
| SHA512 | 4cbb8bda8609404fe84ca36a8cbfe1d69c55dee2b969231b2fa00ca9139d956196a2babbb80a1a2bb430a34e6bd335294f452bcbe9e44411561ebdf21e4aba91 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-rtlsupport-l1-1-0.dll
| MD5 | 0b30c6862b5224cc429fe2eb2b7bf14b |
| SHA1 | 5c3affa14e3bfdafe09e9841a2920b57c7fcbc56 |
| SHA256 | d9c6f93c4972db08c7888d55e8e59e8aba022d416817d65bc96e5a258c859b5f |
| SHA512 | b378f2a2812245ea948d81a925d041dbd7e7a8fb2770cf7dd47643da20f5c685c6121479f95b293177a9480290b17c49e7b4fc10d33734cf883d2c614daae1bf |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-profile-l1-1-0.dll
| MD5 | 1be729c6d9bf1b58f435b23e7f87ba49 |
| SHA1 | 4b2df3fab46a362ee46057c344995fa622e0672a |
| SHA256 | 4c425fbb8d2319d838733ab9cec63a576639192d993909e70cf84f49c107f785 |
| SHA512 | ceccc5ff2bd90a91cfbb948f979576795ff0a9503ddaafd268c14306f93d887975bd376b62ed688be51bb88b3a0c54ef332be93b4b0d8737b5ab70a661b11416 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 774aa9f9318880cb4ad3bf6f464da556 |
| SHA1 | 3a5c07cf35009c98eb033e1cbde1900135d1abf8 |
| SHA256 | ba9fbd3a21879614c050c86a74ad2fffc0362266d6fa7be0ef359de393136346 |
| SHA512 | f7b57afb9810e3390d27a5469572fb29f0f1726f599403a180e685466237dff5dec4fdce40105ef1bb057e012d546308213e7cec73e0d7d3c5815eec8189a75d |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-processthreads-l1-1-0.dll
| MD5 | 73586decad3b3d90653750504b356a5c |
| SHA1 | 39a7ee1660ca1291314ef78150e397b1d8683e03 |
| SHA256 | 34f560c3e56f40db5df695c967b6e302e961085bc037bb9a1c2d2c866a9df48f |
| SHA512 | 9ec299e930d2b89ad379613f8fa63669ec7c858da8a24608b92175f42b0be75f8aa2e1727dabf7638ae9d2942d03840f288eab53f2c9f38dbea1325f1ea8b22b |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-processenvironment-l1-1-0.dll
| MD5 | 4f1303827a67760d02feb54e9258edb1 |
| SHA1 | 340d7029c39708d14da79b12a0e2ed0a8bc7c020 |
| SHA256 | 77fc9adf1a734d9717700b038b98b4337a494fc4f7e1e706c82e97dbca896fd8 |
| SHA512 | 20f067d1c2749c709e4fc45da8d9eb5b813f54d0e09fa482d00bc4a7e5744c587d0afc00cdd5263b4223fe94baa3f8ca110d010339f9e3f1c6b2700888dbe3d0 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 3589557535bba7641da3d76eefb0c73d |
| SHA1 | 6f63107c2212300c7cd1573059c08b43e5bd9b95 |
| SHA256 | 642b01bb93d2cb529acf56070d65aae3202fd0b48d19fd40ec6763b627bcbee6 |
| SHA512 | 7aedf3cf686b416f8b419f8af1d57675096ab2c2378c5a006f6ecbf2fe1ad701f28b7be8f08c9083230cf4d15d463371e92a6032178cd6c139d60b26fbd49b06 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-libraryloader-l1-1-0.dll
| MD5 | d042aa497ce2a9f03296f8de68ed0680 |
| SHA1 | f483a343a18b960630ccf0e6de2f82883550f3bf |
| SHA256 | de3d2c5519f74a982f06f3f3fda085571c0cdcf5ad8d2d331c79d9c92062bdc3 |
| SHA512 | 4e157c8701860982ce0dec956fe4bfb684d2db3eaa9e784f179d385be905fd0551ba90cc27c54179fc39a693d9c742364f2bf1a5444424ba5eae38103b5f0e02 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-interlocked-l1-1-0.dll
| MD5 | 5872cb5ca3980697283aab9007196ae6 |
| SHA1 | 26e8de47d9bee371f6c7a47f206a131965b6b481 |
| SHA256 | 0dff50774693fcb71782b5e214419032a8c00b3031151d93be5c971b6f62cd45 |
| SHA512 | 9b3e2fa9f66d29bfc7a4ca5d673b395bcda223a85fd06c94a11217047c1a312148c9c6270d7f69dfef06b25f8b5ad46717a829bde55f540c804a4ba4c4af070c |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-heap-l1-1-0.dll
| MD5 | a8b967b65232ecce7261eaecf39e7d6d |
| SHA1 | df0792b29c19d46a93291c88a497151a0ba4366d |
| SHA256 | 8fcc9a97a8ad3be9a8d0ce6bb502284dd145ebbe587b42cdeaa4262279517c1d |
| SHA512 | b8116208eb646ec1c103f78c768c848eb9d8d7202ebdab4acb58686e6f0706f0d6aaa884e11065d7ece63ebbd452f35b1422bd79e6eb2405fb1892758195ccbb |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-handle-l1-1-0.dll
| MD5 | 567ff20a8d330cbb3278d3360c8d56f5 |
| SHA1 | cdf0cfc650da3a1b57dc3ef982a317d37ffb974d |
| SHA256 | 47dfbe1ecc8abc002bd52dcd5281ed7378d457789be4cb1e9bee369150d7f5c8 |
| SHA512 | 1643e900f13509f0ef9c7b7f8f2401fb3b6f2c0c39b512c623615df92b1e69df042ef1a0c6aace82173ce5d4d3c672c1636d6ee05545ce5c3b7374ab745e0e87 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-file-l2-1-0.dll
| MD5 | bfffa7117fd9b1622c66d949bac3f1d7 |
| SHA1 | 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2 |
| SHA256 | 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e |
| SHA512 | b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-file-l1-2-0.dll
| MD5 | 2b36752a5157359da1c0e646ee9bec45 |
| SHA1 | 708aeb7e945c9c709109cea359cb31bd7ac64889 |
| SHA256 | 3e3eb284937b572d1d70ce27be77b5e02eb73704c8b50feb5eb933db1facd2fc |
| SHA512 | fc56080362506e3f38f1b3eb9d3193cdb9e576613c2e672f0fe9df203862f8a0f31938fa48b4ff7115dfe6016fa1fd5c5422fdc1913df63b3fde5f478a8417a1 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-file-l1-1-0.dll
| MD5 | abf9850eb219be4976a94144a9eba057 |
| SHA1 | 3d8c37588b36296240934b2f63a1b135a52fcee2 |
| SHA256 | 41c5c577fea3ce13d5beb64ce0920f1061f65bcf39eafa8cd3dfc09ff48bcf76 |
| SHA512 | dfaafb43ce7f05b2db35eac10b314fb506c6aada80f6c4327b09ec33c170478ebd0eea19f1c6ca2e4832bfa41f769046deca8f15d54b7966134d166ee6036bda |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-errorhandling-l1-1-0.dll
| MD5 | 98340ffd2b1d8affef27d4b1260aeac5 |
| SHA1 | b428b39aa814a7038a1ddff9b64b935f51833a26 |
| SHA256 | 7388a019922e9a0a3d05a8605a5307e3141b39f7d57b7faca5d34e72adfd5fa5 |
| SHA512 | 6165c5be0360d55403e9dfd4e9df4ff9a12e5fb6057ed9278da09e688751487e46d9dd64949375c00764cbb4355cc13a1ea714055050f2ab7d432977b8443f81 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-debug-l1-1-0.dll
| MD5 | a00ebd3cf88d668be6d62a25fa4fb525 |
| SHA1 | edb07eafd08991611389293e2be80f8ee98f1e62 |
| SHA256 | b44646453584305d4edf8ab5f5d1adea6b9650bd2b75f8486fc275be52b86433 |
| SHA512 | d63f0e9f2e079ee06aa3ab96a0bd2d169564896027b731ee2597327bdc55456c5fd0c2d8c7e68165fc80bbc3fe0c24a3388d4c3615f33fc9f9fc0b205ae9ba7a |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-datetime-l1-1-0.dll
| MD5 | 3095c9577395249e105410bdcc585f77 |
| SHA1 | 7dfc0c81f8f28cbf36c5acdb83523569b430b944 |
| SHA256 | c08be448195f46c4b423d0ce0c2cdc343e842ff1f91b16a8d3c09d5152150917 |
| SHA512 | 555568fc23ade238bcc13a447520d395546def4409a002d795dd3abea03b15321491bc63c97f4ed8eb78aa411a0b1267dce5c528e51dcac8ca9e93b8f5265786 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-console-l1-1-0.dll
| MD5 | a148dc22ea14cd5578de22b2dfb0917f |
| SHA1 | eaccb66f62e5b6d7154798e596eabd3cef00b982 |
| SHA256 | 7603e172853a9711fbdc53b080432ad12984b463768dbc3aa842a26f5b26ae23 |
| SHA512 | 4e3c927692fc41889b596273aea8bbd776cf7644dae26c411c12bda23cd3299a5c9adc06a930294310f002de74592a244767378fc9e37ec76e86bfa23f4c0478 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\libffi-8.dll
| MD5 | 0f8e4992ca92baaf54cc0b43aaccce21 |
| SHA1 | c7300975df267b1d6adcbac0ac93fd7b1ab49bd2 |
| SHA256 | eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a |
| SHA512 | 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-namedpipe-l1-1-0.dll
| MD5 | d1bc9b3a7aa94d10c41fa16210aa9dba |
| SHA1 | a358b824b1f26ead420d2100e5f1a3fb74af2b7a |
| SHA256 | 75652caf05e86adc88ed214fd208b4a289489cac2b28fd358e302e2e7c3c338f |
| SHA512 | 149478dfca0165d5a68e89070017cda3400926284eaa2143a810138ff710079cde413c031721de5b58cb834f03d4c5df5b4bd6c2bdb65687755ad77cae778b30 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\api-ms-win-core-memory-l1-1-0.dll
| MD5 | 064fb2e1b5e90796a68d1edf91269ad3 |
| SHA1 | 6e3a8c568f038879b7b102975a4471b2489f5493 |
| SHA256 | 3500935e638f7d0ae2bf564bf77f9329811329261185fcdb9cd702b999889ffd |
| SHA512 | 821f091529d45531811a73664473cebb372a310d855e1a4c1a028ad4dc7d36146d3030dcf10de8a4a4bf16fb535fe3d0d2e1fcd22959690842388abb177b0036 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\python3.dll
| MD5 | 7e07c63636a01df77cd31cfca9a5c745 |
| SHA1 | 593765bc1729fdca66dd45bbb6ea9fcd882f42a6 |
| SHA256 | db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6 |
| SHA512 | 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729 |
C:\Users\Admin\AppData\Local\Temp\_MEI35922\base_library.zip
| MD5 | 4b011f052728ae5007f9ec4e97a4f625 |
| SHA1 | 9d940561f08104618ec9e901a9cd0cd13e8b355d |
| SHA256 | c88cd8549debc046a980b0be3bf27956ae72dcdcf1a448e55892194752c570e6 |
| SHA512 | be405d80d78a188a563086809c372c44bcd1ccab5a472d50714f559559795a1df49437c1712e15eb0403917c7f6cfaf872d6bb0c8e4dd67a512c2c4a5ae93055 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-05-25 22:45
Reported
2024-05-25 22:47
Platform
win7-20240220-en
Max time kernel
103s
Max time network
16s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc\ = "pyc_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2040 wrote to memory of 2516 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2040 wrote to memory of 2516 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2040 wrote to memory of 2516 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2516 wrote to memory of 2532 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2516 wrote to memory of 2532 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2516 wrote to memory of 2532 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2516 wrote to memory of 2532 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\troll.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\troll.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\troll.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | a429dfd97046a4c8c78914eab4a0df04 |
| SHA1 | 8ac388cf0fd1fdc60e98be588e3426cb24b5ed54 |
| SHA256 | b575d43416db77cacbb35f60e4ad599b84e47b09c0d962bf48a6180fed819e1c |
| SHA512 | e9cb220d221dcb7f81a5937391ef949fa2f2674fb3f7b819ff5704512f047f4ea6dcf5ea843e65acde8d28e6cf45a25473db47c5d0ed312ee76450d24bc309bf |
Analysis: behavioral4
Detonation Overview
Submitted
2024-05-25 22:45
Reported
2024-05-25 22:48
Platform
win10v2004-20240426-en
Max time kernel
148s
Max time network
152s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\troll.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.71.105.51.in-addr.arpa | udp |