Analysis Overview
SHA256
a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669
Threat Level: Likely malicious
The file a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669 was found to be: Likely malicious.
Malicious Activity Summary
Blocklisted process makes network request
Executes dropped EXE
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
VMProtect packed file
ASPack v2.12-2.42
Enumerates connected drives
Writes to the Master Boot Record (MBR)
Adds Run key to start application
UPX packed file
Unsigned PE
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetWindowsHookEx
Checks processor information in registry
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Runs ping.exe
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-16 02:56
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-16 02:56
Reported
2024-10-16 02:58
Platform
win7-20240903-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dhbhl.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dhbhl.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\xsitcbm\\jglpad.gpj\",Exit" | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\m: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\q: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\g: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\j: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\p: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\s: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\u: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\y: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\t: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\v: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\a: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\b: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\h: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\i: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\n: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\r: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\w: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\x: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\z: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\e: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\k: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\l: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\o: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PHYSICALDRIVE0 | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\dhbhl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dhbhl.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe
"C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\dhbhl.exe "C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
C:\Users\Admin\AppData\Local\Temp\dhbhl.exe
C:\Users\Admin\AppData\Local\Temp\\dhbhl.exe "C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe"
\??\c:\windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.exe "c:\xsitcbm\jglpad.gpj",Exit C:\Users\Admin\AppData\Local\Temp\dhbhl.exe
Network
| Country | Destination | Domain | Proto |
| US | 107.163.43.248:12388 | tcp | |
| US | 107.163.43.248:12388 | tcp | |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 107.163.43.245:10289 | tcp | |
| US | 107.163.43.245:10289 | tcp | |
| US | 107.163.43.245:10289 | tcp | |
| US | 107.163.43.245:10289 | tcp |
Files
memory/3008-0-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3008-2-0x0000000000400000-0x0000000000466000-memory.dmp
\Users\Admin\AppData\Local\Temp\dhbhl.exe
| MD5 | 1d551b884ea7507e5a33afa01451837f |
| SHA1 | cdee6f435aac48c43eb0fdf6ea63ae7e63c74a71 |
| SHA256 | 3408e944ef616aab531710b202094e4389f35472a3d511ae8ada0e784850e0ee |
| SHA512 | 9d05723ff187a78f99fa6f09f9906455611ebb5dda4f13351107e466f3460ffc0a9091b3f24a0d0da2ae41324e7ef850ae95b46136f2fda9b918c14e5c346186 |
memory/2160-7-0x00000000022D0000-0x0000000002336000-memory.dmp
memory/2160-6-0x00000000022D0000-0x0000000002336000-memory.dmp
memory/1264-10-0x0000000000400000-0x0000000000466000-memory.dmp
\??\c:\xsitcbm\jglpad.gpj
| MD5 | 64597ebd5759f1c96d9c89ba91e6b9ae |
| SHA1 | 22b5c32c02e7d98384b5d364d4e88805a988e58a |
| SHA256 | 8fe1d9492012107c64090e2bbed51ca84f46f0828bd95b18326f776e694e3bcb |
| SHA512 | 88cf508773b316acafafc5882dd6a50f895a4f444cfa0ef25781c0c5bbd8eba69e38b777460e66ee2cb25e6c61b699b0120788e00b2a0018bc02d07d644d076f |
memory/2840-13-0x0000000010000000-0x0000000010037000-memory.dmp
memory/2840-14-0x0000000010034000-0x0000000010035000-memory.dmp
memory/2840-15-0x0000000010000000-0x0000000010037000-memory.dmp
memory/2840-16-0x0000000010000000-0x0000000010037000-memory.dmp
memory/2840-18-0x0000000010034000-0x0000000010035000-memory.dmp
memory/2840-17-0x0000000010000000-0x0000000010037000-memory.dmp
memory/2840-22-0x0000000010000000-0x0000000010037000-memory.dmp
memory/2840-23-0x0000000010000000-0x0000000010037000-memory.dmp
memory/2840-24-0x0000000010000000-0x0000000010037000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-16 02:56
Reported
2024-10-16 02:58
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
143s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ukoya.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ukoya.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\yxbbtk\\dthox.tod\",Exit" | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\b: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\g: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\m: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\s: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\w: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\x: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\z: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\j: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\o: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\q: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\r: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\t: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\u: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\a: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\e: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\h: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\l: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\i: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\k: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\n: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\p: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\v: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| File opened (read-only) | \??\y: | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PHYSICALDRIVE0 | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ukoya.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | \??\c:\windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ukoya.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe
"C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\ukoya.exe "C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
C:\Users\Admin\AppData\Local\Temp\ukoya.exe
C:\Users\Admin\AppData\Local\Temp\\ukoya.exe "C:\Users\Admin\AppData\Local\Temp\a9e225acd55a36761bb040f76bde125e9b3d91d6b84426e9a54f34567df80669.exe"
\??\c:\windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.exe "c:\yxbbtk\dthox.tod",Exit C:\Users\Admin\AppData\Local\Temp\ukoya.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 107.163.43.248:12388 | 107.163.43.248 | tcp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.117.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 107.163.43.245:10289 | 107.163.43.245 | tcp |
| US | 107.163.43.245:10289 | 107.163.43.245 | tcp |
| US | 8.8.8.8:53 | 245.43.163.107.in-addr.arpa | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 107.163.43.245:10289 | tcp | |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | host123.zz.am | udp |
| US | 8.8.8.8:53 | udp |
Files
memory/4660-0-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4660-2-0x0000000000400000-0x0000000000466000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ukoya.exe
| MD5 | 2bef44584ff29840ae7b1e511ea7c424 |
| SHA1 | 3234f8d7508ebb22c2a857f54a45de6a20961e40 |
| SHA256 | 695a539fea5e45e7671afdce36a7567d73bb0271f322c51b64ca1675bf76a1b7 |
| SHA512 | 7edfc088e964ea8909ca17fb12e831fb41dadc246896c8bff475301cd8144f5839cfba8231fbe92e6ff1b8cc8acf0150f7187373657ebd24ca4b7ee46b682c81 |
memory/4836-7-0x0000000000400000-0x0000000000466000-memory.dmp
\??\c:\yxbbtk\dthox.tod
| MD5 | 64597ebd5759f1c96d9c89ba91e6b9ae |
| SHA1 | 22b5c32c02e7d98384b5d364d4e88805a988e58a |
| SHA256 | 8fe1d9492012107c64090e2bbed51ca84f46f0828bd95b18326f776e694e3bcb |
| SHA512 | 88cf508773b316acafafc5882dd6a50f895a4f444cfa0ef25781c0c5bbd8eba69e38b777460e66ee2cb25e6c61b699b0120788e00b2a0018bc02d07d644d076f |
memory/672-10-0x0000000010000000-0x0000000010037000-memory.dmp
memory/672-12-0x0000000010000000-0x0000000010037000-memory.dmp
memory/672-11-0x0000000010000000-0x0000000010037000-memory.dmp
memory/672-13-0x0000000010000000-0x0000000010037000-memory.dmp
memory/672-16-0x0000000010000000-0x0000000010037000-memory.dmp
memory/672-17-0x0000000010000000-0x0000000010037000-memory.dmp
memory/672-18-0x0000000010000000-0x0000000010037000-memory.dmp