Malware Analysis Report

2024-08-06 14:43

Sample ID 240617-ktkkgaxdmm
Target b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118
SHA256 13a09fcb282fa9b82b403819042280cb2b676260d0ea092899be06fe8fa69612
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

13a09fcb282fa9b82b403819042280cb2b676260d0ea092899be06fe8fa69612

Threat Level: Known bad

The file b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-17 08:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 08:53

Reported

2024-06-17 08:56

Platform

win7-20240508-en

Max time kernel

138s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\app.exe -boot" C:\Users\Admin\AppData\Local\app.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe" C:\Users\Admin\AppData\Local\app.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\app.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2524 set thread context of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe C:\Users\Admin\AppData\Local\app.exe N/A
File created C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe C:\Users\Admin\AppData\Local\app.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\app.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\app.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\app.exe
PID 3028 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\app.exe
PID 3028 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\app.exe
PID 3028 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2524 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 1864 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 1864 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 1864 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 1864 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 1864 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 1864 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 1864 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 1864 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\app.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\app.exe"

C:\Users\Admin\AppData\Local\app.exe

"C:\Users\Admin\AppData\Local\app.exe"

C:\Users\Admin\AppData\Local\app.exe

"C:\Users\Admin\AppData\Local\app.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp64CB.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp652A.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 anyi.ddns.net udp
US 8.8.4.4:53 anyi.ddns.net udp
US 8.8.8.8:53 anyi.ddns.net udp
US 8.8.8.8:53 anyi.ddns.net udp
US 8.8.4.4:53 anyi.ddns.net udp

Files

memory/3016-0-0x00000000740FE000-0x00000000740FF000-memory.dmp

memory/3016-1-0x0000000000DF0000-0x0000000000E72000-memory.dmp

memory/3016-2-0x00000000740F0000-0x00000000747DE000-memory.dmp

memory/3016-3-0x0000000000350000-0x0000000000360000-memory.dmp

memory/3016-6-0x00000000740FE000-0x00000000740FF000-memory.dmp

memory/3016-7-0x00000000740F0000-0x00000000747DE000-memory.dmp

C:\Users\Admin\AppData\Local\app.exe

MD5 b7bfbe5327957e4d9d3d6d8b224eab37
SHA1 49699c7aabb20f9a524a6e24a961cad666d74cb1
SHA256 13a09fcb282fa9b82b403819042280cb2b676260d0ea092899be06fe8fa69612
SHA512 73cbde5fa1bf2573fd49f378db352c45e509b38c67895a18bfd55ee695ed98dab5dee90b42ff1cdf502c57ba478cacebe4232d4898d5ec115666727b14bb594b

memory/3016-12-0x00000000740F0000-0x00000000747DE000-memory.dmp

memory/2524-11-0x0000000001100000-0x0000000001182000-memory.dmp

memory/1864-13-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1864-16-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1864-15-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp64CB.tmp

MD5 db38cdeb3601508a120b6723d0a376ad
SHA1 72eefd94955dc045fc48a38cdec6635330fa6f6e
SHA256 3fcbc7c0f18bd41d5f3e82642c82b5418fd78567a65996bf9972ea055caaf5ad
SHA512 2082a6175e081ac5f89ebd30d0e94350b5d6ad0732124606651f41a22ddb203a2ceb704537da96c14012c2545cafb1d8cbfd671802c6daac3dd95cff2292b9f8

C:\Users\Admin\AppData\Local\Temp\tmp652A.tmp

MD5 981e126601526eaa5b0ad45c496c4465
SHA1 d610d6a21a8420cc73fcd3e54ddae75a5897b28b
SHA256 11ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527
SHA512 a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb

memory/1864-24-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

memory/1864-25-0x0000000000B30000-0x0000000000B4E000-memory.dmp

memory/1864-26-0x0000000000AE0000-0x0000000000AEA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 08:53

Reported

2024-06-17 08:56

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\app.exe -boot" C:\Users\Admin\AppData\Local\app.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Service = "C:\\Program Files (x86)\\AGP Service\\agpsv.exe" C:\Users\Admin\AppData\Local\app.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\app.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2012 set thread context of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\AGP Service\agpsv.exe C:\Users\Admin\AppData\Local\app.exe N/A
File opened for modification C:\Program Files (x86)\AGP Service\agpsv.exe C:\Users\Admin\AppData\Local\app.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\app.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\app.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\app.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3416 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\app.exe
PID 3416 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\app.exe
PID 3416 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\app.exe
PID 2012 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2012 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2012 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2012 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2012 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2012 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2012 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 2012 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\app.exe C:\Users\Admin\AppData\Local\app.exe
PID 4824 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 4824 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 4824 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 4824 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 4824 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe
PID 4824 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\app.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\b7bfbe5327957e4d9d3d6d8b224eab37_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\app.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\app.exe"

C:\Users\Admin\AppData\Local\app.exe

"C:\Users\Admin\AppData\Local\app.exe"

C:\Users\Admin\AppData\Local\app.exe

"C:\Users\Admin\AppData\Local\app.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8AB7.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "AGP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8B35.tmp"

Network

Country Destination Domain Proto
US 52.111.229.43:443 tcp
US 8.8.8.8:53 anyi.ddns.net udp
US 8.8.4.4:53 anyi.ddns.net udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 anyi.ddns.net udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 anyi.ddns.net udp
US 8.8.4.4:53 anyi.ddns.net udp
US 8.8.8.8:53 anyi.ddns.net udp

Files

memory/4480-0-0x000000007464E000-0x000000007464F000-memory.dmp

memory/4480-1-0x0000000000870000-0x00000000008F2000-memory.dmp

memory/4480-2-0x00000000052C0000-0x000000000535C000-memory.dmp

memory/4480-3-0x0000000005910000-0x0000000005EB4000-memory.dmp

memory/4480-4-0x0000000005360000-0x00000000053F2000-memory.dmp

memory/4480-5-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/4480-6-0x0000000005400000-0x0000000005410000-memory.dmp

memory/4480-7-0x0000000005590000-0x000000000559A000-memory.dmp

memory/4480-10-0x000000007464E000-0x000000007464F000-memory.dmp

memory/4480-11-0x0000000074640000-0x0000000074DF0000-memory.dmp

C:\Users\Admin\AppData\Local\app.exe

MD5 b7bfbe5327957e4d9d3d6d8b224eab37
SHA1 49699c7aabb20f9a524a6e24a961cad666d74cb1
SHA256 13a09fcb282fa9b82b403819042280cb2b676260d0ea092899be06fe8fa69612
SHA512 73cbde5fa1bf2573fd49f378db352c45e509b38c67895a18bfd55ee695ed98dab5dee90b42ff1cdf502c57ba478cacebe4232d4898d5ec115666727b14bb594b

memory/2012-18-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/2012-17-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/4480-13-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/2012-19-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/4824-20-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2012-23-0x0000000074640000-0x0000000074DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8AB7.tmp

MD5 db38cdeb3601508a120b6723d0a376ad
SHA1 72eefd94955dc045fc48a38cdec6635330fa6f6e
SHA256 3fcbc7c0f18bd41d5f3e82642c82b5418fd78567a65996bf9972ea055caaf5ad
SHA512 2082a6175e081ac5f89ebd30d0e94350b5d6ad0732124606651f41a22ddb203a2ceb704537da96c14012c2545cafb1d8cbfd671802c6daac3dd95cff2292b9f8

C:\Users\Admin\AppData\Local\Temp\tmp8B35.tmp

MD5 7a81ae69c04c8d95261eb5f490b7f869
SHA1 9f4f484d306fea15b2e7f9f16db660833bb1f8ce
SHA256 ce3933e772f663a834335cc2071e5e7b2d49a065b51d84a259054b8ef663e785
SHA512 8260ab83106752a488e164bbed63ef334d34399bc9a5c09a0cfceba6aef48eafe5c64e4dfbd353ac3edfff2523b16c2b0287d34833a293c4436e068fae656de8

memory/4824-31-0x0000000005130000-0x000000000513A000-memory.dmp

memory/4824-32-0x00000000054F0000-0x000000000550E000-memory.dmp

memory/4824-33-0x0000000006280000-0x000000000628A000-memory.dmp