Malware Analysis Report

2025-08-10 22:51

Sample ID 240107-x2caaacceq
Target a1221c43754f0bf8adfe72560dabb5e2.exe
SHA256 c4edf15d1762c66cdd4fc361fc423ce59fe23b5bea8609f611bd0c0518f5f39c
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c4edf15d1762c66cdd4fc361fc423ce59fe23b5bea8609f611bd0c0518f5f39c

Threat Level: Known bad

The file a1221c43754f0bf8adfe72560dabb5e2.exe was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Sets service image path in registry

Modifies Windows Firewall

Creates new service(s)

Executes dropped EXE

Deletes itself

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-07 19:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-07 19:20

Reported

2024-01-07 19:25

Platform

win7-20231215-en

Max time kernel

202s

Max time network

230s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\cvczdxzt\ImagePath = "C:\\Windows\\SysWOW64\\cvczdxzt\\agrcujdp.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 576 set thread context of 2344 N/A C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2544 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 2544 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\netsh.exe
PID 2544 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\netsh.exe
PID 2544 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\netsh.exe
PID 2544 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\netsh.exe
PID 576 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe C:\Windows\SysWOW64\svchost.exe
PID 576 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe C:\Windows\SysWOW64\svchost.exe
PID 576 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe C:\Windows\SysWOW64\svchost.exe
PID 576 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe C:\Windows\SysWOW64\svchost.exe
PID 576 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe C:\Windows\SysWOW64\svchost.exe
PID 576 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe

"C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cvczdxzt\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\agrcujdp.exe" C:\Windows\SysWOW64\cvczdxzt\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create cvczdxzt binPath= "C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe /d\"C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description cvczdxzt "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start cvczdxzt

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe

C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe /d"C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.111:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
US 108.177.127.27:25 smtp.google.com tcp
HK 43.231.4.6:443 tcp

Files

memory/2544-1-0x0000000000C90000-0x0000000000D90000-memory.dmp

memory/2544-2-0x00000000002C0000-0x00000000002D3000-memory.dmp

memory/2544-3-0x0000000000400000-0x0000000000C17000-memory.dmp

memory/2544-4-0x0000000000400000-0x0000000000C17000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\agrcujdp.exe

MD5 942896d9800fa71b399e4893a1211fe4
SHA1 bc4054f5b9f39e734d12c6aaf3bfa66925cd45d9
SHA256 1583698b26fe9e3bd95b0c367d580630aa645cb118dc7c774933c731e4c8d648
SHA512 239e12cb278881f2936e6b010bbdaa82114f33f8d0a8a109045c9d97d1478a5fe6eb2a24f07d3c800d1dd7541666386cb1ccd9a94c1c9a9a242dc9b379338f77

memory/2544-7-0x0000000000400000-0x0000000000C17000-memory.dmp

memory/2544-9-0x00000000002C0000-0x00000000002D3000-memory.dmp

memory/2544-8-0x0000000000400000-0x0000000000C17000-memory.dmp

C:\Windows\SysWOW64\cvczdxzt\agrcujdp.exe

MD5 9d460bd0337e45c16e8bcabce4bf9d52
SHA1 68fa7fe0e084c4106838d566c5259101b0c0fa6b
SHA256 403c04935731b773463663ac2e4dda52cb3d4d73cf6d43f086885482dceaaee7
SHA512 e10289b3ba577e09debe5ae74925dc89f0093c8c68befe8f3062715218a06511d2c1c188cf573a1c72222deee9e5d2e02e65c9dae63a020a03c4e70454206721

memory/576-12-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

memory/576-13-0x0000000000400000-0x0000000000C17000-memory.dmp

memory/2344-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2344-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2344-17-0x0000000000080000-0x0000000000095000-memory.dmp

memory/576-18-0x0000000000400000-0x0000000000C17000-memory.dmp

memory/2344-21-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2344-22-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2344-23-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2344-24-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-07 19:20

Reported

2024-01-07 19:23

Platform

win10v2004-20231215-en

Max time kernel

158s

Max time network

172s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zizhabjm\ImagePath = "C:\\Windows\\SysWOW64\\zizhabjm\\jnuesfnd.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3236 set thread context of 4144 N/A C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3796 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 3796 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 3796 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 3796 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 3796 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 3796 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\cmd.exe
PID 3796 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\sc.exe
PID 3796 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\netsh.exe
PID 3796 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\netsh.exe
PID 3796 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe C:\Windows\SysWOW64\netsh.exe
PID 3236 wrote to memory of 4144 N/A C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe C:\Windows\SysWOW64\svchost.exe
PID 3236 wrote to memory of 4144 N/A C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe C:\Windows\SysWOW64\svchost.exe
PID 3236 wrote to memory of 4144 N/A C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe C:\Windows\SysWOW64\svchost.exe
PID 3236 wrote to memory of 4144 N/A C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe C:\Windows\SysWOW64\svchost.exe
PID 3236 wrote to memory of 4144 N/A C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe

"C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zizhabjm\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jnuesfnd.exe" C:\Windows\SysWOW64\zizhabjm\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create zizhabjm binPath= "C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe /d\"C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description zizhabjm "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start zizhabjm

C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe

C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe /d"C:\Users\Admin\AppData\Local\Temp\a1221c43754f0bf8adfe72560dabb5e2.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3796 -ip 3796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1156

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3236 -ip 3236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 512

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 77.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.204.79:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
US 108.177.127.27:25 smtp.google.com tcp
US 8.8.8.8:53 83.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.179.17.96.in-addr.arpa udp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 62.179.17.96.in-addr.arpa udp

Files

memory/3796-1-0x0000000000CA0000-0x0000000000DA0000-memory.dmp

memory/3796-2-0x0000000002820000-0x0000000002833000-memory.dmp

memory/3796-4-0x0000000000400000-0x0000000000C17000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jnuesfnd.exe

MD5 fecc4e9436d9c5b3b4a0d93ed1253a8c
SHA1 b55e7bb44cec08479f89b359d5a9c337cadb3427
SHA256 fb948ef5f98b1bc2d918c304b5239112d05463469b837a9939d8ede3cc782f4f
SHA512 8d278e1d527565deabc94bc7f9be6a7b36cd3a7f1eacb3302d95a7eff7f659f3f8084fc82194d32c898bb573c0dd2d10b4bcaa2c9a8cdec9f4edebc9098d0ce8

C:\Windows\SysWOW64\zizhabjm\jnuesfnd.exe

MD5 2785c4e847e54a0c04442c60d65e110e
SHA1 fc92411daa3417697e3eeb5bad517376946ca114
SHA256 999eb3c207ababc5d71cf7c726adf7ecd6ffeff98f98a9687c42684120848692
SHA512 1d4d7826f0d3f3bdc6b9077385a81d56c45a4e6c080fc09aa49e64495819d7dd0ced1050fbd6a0badef319943782b1c892984f5dfe71068c0695102972d39d14

memory/3796-7-0x0000000000400000-0x0000000000C17000-memory.dmp

memory/3796-8-0x0000000002820000-0x0000000002833000-memory.dmp

memory/4144-15-0x0000000001000000-0x0000000001015000-memory.dmp

memory/4144-18-0x0000000001000000-0x0000000001015000-memory.dmp

memory/3236-17-0x0000000000400000-0x0000000000C17000-memory.dmp

memory/4144-16-0x0000000001000000-0x0000000001015000-memory.dmp

memory/3236-13-0x0000000000400000-0x0000000000C17000-memory.dmp

memory/4144-11-0x0000000001000000-0x0000000001015000-memory.dmp

memory/3236-10-0x0000000000EE0000-0x0000000000FE0000-memory.dmp

memory/4144-19-0x0000000001000000-0x0000000001015000-memory.dmp