Malware Analysis Report

2025-06-16 05:08

Sample ID 240313-e857tsch2y
Target c4fefd261e956faeb02c99c55eef2ad5
SHA256 a998fde5f82f852df97cef9e0d2ed596f46eeb509a37c0603c92f5629098fac8
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a998fde5f82f852df97cef9e0d2ed596f46eeb509a37c0603c92f5629098fac8

Threat Level: Known bad

The file c4fefd261e956faeb02c99c55eef2ad5 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Windows security bypass

Modifies Windows Firewall

Creates new service(s)

Sets service image path in registry

Checks computer location settings

Deletes itself

Executes dropped EXE

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 04:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 04:37

Reported

2024-03-13 04:40

Platform

win7-20240221-en

Max time kernel

147s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\kmvssopd = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kmvssopd\ImagePath = "C:\\Windows\\SysWOW64\\kmvssopd\\quxtfolh.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2552 set thread context of 2448 N/A C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2988 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2988 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 2552 wrote to memory of 2448 N/A C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2448 N/A C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2448 N/A C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2448 N/A C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2448 N/A C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe C:\Windows\SysWOW64\svchost.exe
PID 2988 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\netsh.exe
PID 2988 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\netsh.exe
PID 2988 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\netsh.exe
PID 2988 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\netsh.exe
PID 2552 wrote to memory of 2448 N/A C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe

"C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kmvssopd\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\quxtfolh.exe" C:\Windows\SysWOW64\kmvssopd\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create kmvssopd binPath= "C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe /d\"C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description kmvssopd "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start kmvssopd

C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe

C:\Windows\SysWOW64\kmvssopd\quxtfolh.exe /d"C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.204.72:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 172.253.116.27:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/2988-2-0x0000000003350000-0x0000000003450000-memory.dmp

memory/2988-3-0x0000000000220000-0x0000000000233000-memory.dmp

memory/2988-4-0x0000000000400000-0x000000000324F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\quxtfolh.exe

MD5 c8baae233f440b597df98730722480e8
SHA1 082d1de78cbdb34744939736b4039161ee5ee75c
SHA256 83a29fdb662bb14ffc9d39f3eb423dfed03f52cb15fdeeebda1c1028111d1934
SHA512 b4435e1d6133b1ed01e6764d4eebd2c4228d4d80cd463e04144020760d17e3da6084aafcdf2131764a000de86b40ea9420336a5555e0e57a1050e5d28e0dd711

memory/2552-8-0x0000000003340000-0x0000000003440000-memory.dmp

memory/2448-9-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2448-13-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2448-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2988-12-0x0000000000400000-0x000000000324F000-memory.dmp

memory/2552-15-0x0000000000400000-0x000000000324F000-memory.dmp

memory/2448-19-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2552-17-0x0000000000400000-0x000000000324F000-memory.dmp

memory/2448-20-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2448-21-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 04:37

Reported

2024-03-13 04:40

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mvepltlz\ImagePath = "C:\\Windows\\SysWOW64\\mvepltlz\\xkkihivv.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5040 set thread context of 4492 N/A C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5068 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 5068 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 5068 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 5068 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 5068 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 5068 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\cmd.exe
PID 5068 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5068 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5068 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5068 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5068 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5068 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5068 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5068 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5068 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\sc.exe
PID 5040 wrote to memory of 4492 N/A C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe C:\Windows\SysWOW64\svchost.exe
PID 5040 wrote to memory of 4492 N/A C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe C:\Windows\SysWOW64\svchost.exe
PID 5040 wrote to memory of 4492 N/A C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe C:\Windows\SysWOW64\svchost.exe
PID 5040 wrote to memory of 4492 N/A C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe C:\Windows\SysWOW64\svchost.exe
PID 5040 wrote to memory of 4492 N/A C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe C:\Windows\SysWOW64\svchost.exe
PID 5068 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\netsh.exe
PID 5068 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\netsh.exe
PID 5068 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe

"C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mvepltlz\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xkkihivv.exe" C:\Windows\SysWOW64\mvepltlz\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create mvepltlz binPath= "C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe /d\"C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description mvepltlz "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start mvepltlz

C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe

C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe /d"C:\Users\Admin\AppData\Local\Temp\c4fefd261e956faeb02c99c55eef2ad5.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.54.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.204.74:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 64.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 172.253.116.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/5068-1-0x00000000032F0000-0x00000000033F0000-memory.dmp

memory/5068-2-0x0000000004F90000-0x0000000004FA3000-memory.dmp

memory/5068-4-0x0000000000400000-0x000000000324F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xkkihivv.exe

MD5 859fc51b5793119a7d4ddaa96c4bef25
SHA1 f6431e4ffc2a0dc92150d70203557fe4b0734f46
SHA256 ad76dd0d7299b6d820ac03ae26d347d328eafe7024caf75226e227cfc6db0926
SHA512 7f82bd1ec7125022123dbafdd7c13c669814e2dc40f985a53574ee056523721b973618bc99f9a3d8dd1ee4addbe5889818bcde111b26497f2e51d4f2c6f6eddc

C:\Windows\SysWOW64\mvepltlz\xkkihivv.exe

MD5 c0323c5d9aa0656f5e5ba59e33dcc80a
SHA1 6ad8ec4831f974b755db2d761a88352c0b7d8374
SHA256 4fb61549e1dd08081162daa605f98744ab6e0db292c03d0f34f342a91ee8cb10
SHA512 b2d40f2ef0340049c92543087194a46b1424adf78088e65b738e54c3177973e85e2ce7feaafd19fb87c46246b7d2d7c7b9ccdd36fb050e3290265cf46ea987b7

memory/5040-8-0x00000000034D0000-0x00000000035D0000-memory.dmp

memory/5040-9-0x00000000034B0000-0x00000000034C3000-memory.dmp

memory/4492-10-0x0000000000FA0000-0x0000000000FB5000-memory.dmp

memory/5040-15-0x0000000000400000-0x000000000324F000-memory.dmp

memory/5040-14-0x0000000000400000-0x000000000324F000-memory.dmp

memory/5068-13-0x0000000000400000-0x000000000324F000-memory.dmp

memory/4492-16-0x0000000000FA0000-0x0000000000FB5000-memory.dmp

memory/4492-17-0x0000000000FA0000-0x0000000000FB5000-memory.dmp

memory/4492-18-0x0000000000FA0000-0x0000000000FB5000-memory.dmp

memory/4492-19-0x0000000000FA0000-0x0000000000FB5000-memory.dmp