Malware Analysis Report

2025-06-16 05:08

Sample ID 240313-g7m1zagg28
Target c5326b8ccd0481b6fc7ea4d0261b15d5
SHA256 3a0812a11a42c0ad5c6a6fa2b2ae73125561d2de24c2177e3794107de6d34f67
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a0812a11a42c0ad5c6a6fa2b2ae73125561d2de24c2177e3794107de6d34f67

Threat Level: Known bad

The file c5326b8ccd0481b6fc7ea4d0261b15d5 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Windows security bypass

Sets service image path in registry

Creates new service(s)

Modifies Windows Firewall

Executes dropped EXE

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 06:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 06:26

Reported

2024-03-13 06:29

Platform

win7-20240221-en

Max time kernel

141s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\rtsnwfhh = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\rtsnwfhh\ImagePath = "C:\\Windows\\SysWOW64\\rtsnwfhh\\fczxjujx.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1604 set thread context of 2460 N/A C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1948 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 1948 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\netsh.exe
PID 1948 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\netsh.exe
PID 1948 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\netsh.exe
PID 1948 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\netsh.exe
PID 1604 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe C:\Windows\SysWOW64\svchost.exe
PID 1604 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe C:\Windows\SysWOW64\svchost.exe
PID 1604 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe C:\Windows\SysWOW64\svchost.exe
PID 1604 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe C:\Windows\SysWOW64\svchost.exe
PID 1604 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe C:\Windows\SysWOW64\svchost.exe
PID 1604 wrote to memory of 2460 N/A C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe

"C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rtsnwfhh\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fczxjujx.exe" C:\Windows\SysWOW64\rtsnwfhh\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create rtsnwfhh binPath= "C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe /d\"C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description rtsnwfhh "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start rtsnwfhh

C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe

C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe /d"C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.54.36:25 microsoft-com.mail.protection.outlook.com tcp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.111:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 74.125.193.27:25 smtp.google.com tcp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
HK 43.231.4.6:443 tcp

Files

memory/1948-1-0x0000000000A50000-0x0000000000B50000-memory.dmp

memory/1948-2-0x0000000000220000-0x0000000000233000-memory.dmp

memory/1948-4-0x0000000000400000-0x00000000008E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fczxjujx.exe

MD5 b89e9f1dfa7ce11aeff8d1f2faa41f9a
SHA1 f9498ea707d7189b08bf685ede05a101bcf7413d
SHA256 64671356c869cff08a7be79d7b3e10a9729b2646e344c30d3e529ef5f670dcdb
SHA512 68d0c74cba0ba5901b938aa5e57e7713b7679585fcc41359f7e4424714dc5ca8cf6b47eff22bb799e583b012e8586d62ca8da004bd3e28ccdee47521e27e5f86

C:\Windows\SysWOW64\rtsnwfhh\fczxjujx.exe

MD5 e2d9c34f2a8c08b6ff142edc6a13e245
SHA1 eb6ea090516e019fc8b279b61bbe55b5fbd72970
SHA256 25dd10f4e6f793072e7c3032503728a1c467adcc0975bb9f03bcfd39d3fdbcdf
SHA512 1757ce9d5cdbfcb1d5aa9eac9428a80536c9e58b7be46462e514d7a5421e13104b7e8aa282e7e3f73032ffc8dab51b160d05a10a1fe6024585094d618f7f3a67

memory/1948-7-0x0000000000400000-0x00000000008E9000-memory.dmp

memory/1948-8-0x0000000000A50000-0x0000000000B50000-memory.dmp

memory/1948-9-0x0000000000220000-0x0000000000233000-memory.dmp

memory/1604-11-0x0000000000A20000-0x0000000000B20000-memory.dmp

memory/1604-12-0x0000000000400000-0x00000000008E9000-memory.dmp

memory/2460-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2460-13-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/1604-17-0x0000000000400000-0x00000000008E9000-memory.dmp

memory/2460-16-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2460-20-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2460-21-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2460-22-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2460-23-0x00000000000C0000-0x00000000000D5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 06:26

Reported

2024-03-13 06:29

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\negjluyh\ImagePath = "C:\\Windows\\SysWOW64\\negjluyh\\qublzmuk.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\negjluyh\qublzmuk.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4124 set thread context of 2724 N/A C:\Windows\SysWOW64\negjluyh\qublzmuk.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4984 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\sc.exe
PID 4984 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\netsh.exe
PID 4984 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\netsh.exe
PID 4984 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe C:\Windows\SysWOW64\netsh.exe
PID 4124 wrote to memory of 2724 N/A C:\Windows\SysWOW64\negjluyh\qublzmuk.exe C:\Windows\SysWOW64\svchost.exe
PID 4124 wrote to memory of 2724 N/A C:\Windows\SysWOW64\negjluyh\qublzmuk.exe C:\Windows\SysWOW64\svchost.exe
PID 4124 wrote to memory of 2724 N/A C:\Windows\SysWOW64\negjluyh\qublzmuk.exe C:\Windows\SysWOW64\svchost.exe
PID 4124 wrote to memory of 2724 N/A C:\Windows\SysWOW64\negjluyh\qublzmuk.exe C:\Windows\SysWOW64\svchost.exe
PID 4124 wrote to memory of 2724 N/A C:\Windows\SysWOW64\negjluyh\qublzmuk.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe

"C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\negjluyh\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qublzmuk.exe" C:\Windows\SysWOW64\negjluyh\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create negjluyh binPath= "C:\Windows\SysWOW64\negjluyh\qublzmuk.exe /d\"C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description negjluyh "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start negjluyh

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4984 -ip 4984

C:\Windows\SysWOW64\negjluyh\qublzmuk.exe

C:\Windows\SysWOW64\negjluyh\qublzmuk.exe /d"C:\Users\Admin\AppData\Local\Temp\c5326b8ccd0481b6fc7ea4d0261b15d5.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1164

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4124 -ip 4124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.54.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.228.94:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 74.125.193.27:25 smtp.google.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
HK 43.231.4.6:443 tcp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/4984-1-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

memory/4984-2-0x0000000002640000-0x0000000002653000-memory.dmp

memory/4984-3-0x0000000000400000-0x00000000008E9000-memory.dmp

memory/4984-5-0x0000000000400000-0x00000000008E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qublzmuk.exe

MD5 3bb6e8afcaa67f72acf23cd413bbdf95
SHA1 b91c5b27090753d6e044e197ea4fdf13fe5da873
SHA256 626fbb5667c3c8de0764fce5f89627178e1b734a6449d82cd745d6ac01c502ab
SHA512 4bd5e525a8a5376694b321af63e5cf7c31fb6d9404578d42aad4aa24fdcb2daba1c2b7b8a2930719ea61680c5da16b809f242c44fd3fe6d5541cc80989f11f6b

C:\Windows\SysWOW64\negjluyh\qublzmuk.exe

MD5 6fe069811fc6c0cb31bddfc5254054eb
SHA1 314bc9a7f39c6f16c5261f6fba99fec506a210c8
SHA256 669329531e5724dc5cf4ceb3c5363265daa5a336ee8fe10d50e60374c016a539
SHA512 296554610e5ef252d08dc7145cbdca036e7c8c78406ebf0ae53b8a429efddb4d941b69e53bc907e1d41f7c4f30ac0c6f5d7370ac983b4d66e068b20ce32e1226

memory/4984-8-0x0000000000400000-0x00000000008E9000-memory.dmp

memory/4984-11-0x0000000002640000-0x0000000002653000-memory.dmp

memory/4124-12-0x0000000000B30000-0x0000000000C30000-memory.dmp

memory/4124-13-0x0000000000400000-0x00000000008E9000-memory.dmp

memory/2724-14-0x0000000000480000-0x0000000000495000-memory.dmp

memory/2724-17-0x0000000000480000-0x0000000000495000-memory.dmp

memory/2724-18-0x0000000000480000-0x0000000000495000-memory.dmp

memory/2724-19-0x0000000000480000-0x0000000000495000-memory.dmp

memory/4124-20-0x0000000000400000-0x00000000008E9000-memory.dmp

memory/2724-21-0x0000000000480000-0x0000000000495000-memory.dmp