Malware Analysis Report

2024-10-23 19:38

Sample ID 240816-mwne9avaqp
Target 9e0f42e136318382ccc4787b2d262849_JaffaCakes118
SHA256 406ed0bcdcb803a5a02bdb3631ff7107353ab6b38b8a23c506559dec6c611558
Tags
nanocore discovery evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

406ed0bcdcb803a5a02bdb3631ff7107353ab6b38b8a23c506559dec6c611558

Threat Level: Known bad

The file 9e0f42e136318382ccc4787b2d262849_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore discovery evasion keylogger persistence spyware stealer trojan

NanoCore

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Scheduled Task/Job: Scheduled Task

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-16 10:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-16 10:49

Reported

2024-08-16 10:51

Platform

win7-20240708-en

Max time kernel

140s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe" C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2444 set thread context of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\UDP Service\udpsv.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A
File opened for modification C:\Program Files (x86)\UDP Service\udpsv.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2444 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2444 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 2792 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2792 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2792 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2792 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2792 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2792 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2792 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 2792 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe

"C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe"

C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe

"{path}"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9369.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp93B8.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp

Files

memory/2444-0-0x0000000074E51000-0x0000000074E52000-memory.dmp

memory/2444-1-0x0000000074E50000-0x00000000753FB000-memory.dmp

memory/2444-2-0x0000000074E50000-0x00000000753FB000-memory.dmp

memory/2444-3-0x0000000074E50000-0x00000000753FB000-memory.dmp

memory/2444-4-0x0000000074E50000-0x00000000753FB000-memory.dmp

memory/2792-18-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-16-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-14-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2792-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-8-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-6-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-5-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-22-0x0000000074E50000-0x00000000753FB000-memory.dmp

memory/2792-21-0x0000000074E50000-0x00000000753FB000-memory.dmp

memory/2444-20-0x0000000074E50000-0x00000000753FB000-memory.dmp

memory/2792-19-0x0000000074E50000-0x00000000753FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9369.tmp

MD5 ba89ab6340e8da135e07afa406fe1f86
SHA1 acb17c4c6bb0fb163a08b0107dc6db6057373215
SHA256 03636c2d24d92a974bf7b32bf691d0874cf97910c706406c3cb2438113116a18
SHA512 d8ba32e377d9fdd8c35f509b7b20d19bbe2c1558c664e7427eb024277835b45f987aed498c5825023720efa42252e8bef19b19335088887992fca2cb63236991

C:\Users\Admin\AppData\Local\Temp\tmp93B8.tmp

MD5 0a24db62cb5b84309c4803346caaa25d
SHA1 67660778f61bb44168c33ed3fe56ed86cf9583e8
SHA256 38d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
SHA512 d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548

memory/2792-30-0x0000000074E50000-0x00000000753FB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-16 10:49

Reported

2024-08-16 10:51

Platform

win10v2004-20240802-en

Max time kernel

143s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisv.exe" C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3140 set thread context of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DPI Service\dpisv.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A
File opened for modification C:\Program Files (x86)\DPI Service\dpisv.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3140 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 3140 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 3140 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 3140 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 3140 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 3140 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 3140 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 3140 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe
PID 552 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe

"C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe"

C:\Users\Admin\AppData\Local\Temp\68ed7131fa19bb7841cda1e98f0d97c5.exe

"{path}"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp441.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DPI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp490.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp
US 8.8.8.8:53 antivirus-firewall.duckdns.org udp
BR 203.159.80.229:5489 antivirus-firewall.duckdns.org tcp

Files

memory/3140-0-0x0000000075492000-0x0000000075493000-memory.dmp

memory/3140-1-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/3140-2-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/3140-3-0x0000000075492000-0x0000000075493000-memory.dmp

memory/3140-4-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/552-5-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\68ed7131fa19bb7841cda1e98f0d97c5.exe.log

MD5 cb76b18ebed3a9f05a14aed43d35fba6
SHA1 836a4b4e351846fca08b84149cb734cb59b8c0d6
SHA256 8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349
SHA512 7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

memory/552-8-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/552-9-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/3140-10-0x0000000075490000-0x0000000075A41000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp441.tmp

MD5 ba89ab6340e8da135e07afa406fe1f86
SHA1 acb17c4c6bb0fb163a08b0107dc6db6057373215
SHA256 03636c2d24d92a974bf7b32bf691d0874cf97910c706406c3cb2438113116a18
SHA512 d8ba32e377d9fdd8c35f509b7b20d19bbe2c1558c664e7427eb024277835b45f987aed498c5825023720efa42252e8bef19b19335088887992fca2cb63236991

C:\Users\Admin\AppData\Local\Temp\tmp490.tmp

MD5 a9af285136db016a568e4a53208f21d0
SHA1 e1afef2b7ee8ae945353315daa19a15574b435b7
SHA256 7dce876e35550f4a5b8ce8a8bbab3b0ccd7c5b8660f9db4b832466b77e3a8b7c
SHA512 80a1f5e463a87cddc0f66336e2dc4262daf98984c6f6c662c3615d615ebe7c58677c3d694edb3bd7816ccee969aae967c7efe8526ba423f274ac1210c0c8bd6e

memory/552-18-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/552-19-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/552-20-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/552-21-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/552-22-0x0000000075490000-0x0000000075A41000-memory.dmp