Malware Analysis Report

2025-06-16 05:08

Sample ID 240313-llfrzsbh53
Target c589e57813712cdca2f4e39ab028c665
SHA256 7c74a5c28e75dc5c494548b2f305d0bd34ac51c4fbe72e32a24df04397fb4cbd
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7c74a5c28e75dc5c494548b2f305d0bd34ac51c4fbe72e32a24df04397fb4cbd

Threat Level: Known bad

The file c589e57813712cdca2f4e39ab028c665 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Windows security bypass

Creates new service(s)

Sets service image path in registry

Modifies Windows Firewall

Checks computer location settings

Deletes itself

Executes dropped EXE

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 09:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 09:37

Reported

2024-03-13 09:39

Platform

win7-20240221-en

Max time kernel

147s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\gqndjmhc = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\gqndjmhc\ImagePath = "C:\\Windows\\SysWOW64\\gqndjmhc\\dfaricjc.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1460 set thread context of 2180 N/A C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2708 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\netsh.exe
PID 2708 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\netsh.exe
PID 2708 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\netsh.exe
PID 2708 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\netsh.exe
PID 1460 wrote to memory of 2180 N/A C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 1460 wrote to memory of 2180 N/A C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 1460 wrote to memory of 2180 N/A C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 1460 wrote to memory of 2180 N/A C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 1460 wrote to memory of 2180 N/A C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 1460 wrote to memory of 2180 N/A C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe

"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gqndjmhc\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dfaricjc.exe" C:\Windows\SysWOW64\gqndjmhc\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create gqndjmhc binPath= "C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe /d\"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description gqndjmhc "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start gqndjmhc

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe

C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe /d"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.0:25 microsoft-com.mail.protection.outlook.com tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.228.94:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 209.85.203.26:25 smtp.google.com tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
HK 43.231.4.7:443 tcp

Files

memory/2708-0-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2708-3-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2708-2-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2708-1-0x0000000000220000-0x0000000000221000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dfaricjc.exe

MD5 0d2f3d1815929fbf65ce1f9469af4728
SHA1 c899b614fcc4b42301f836c3fcd8e6e973a76c76
SHA256 95e141e8d3f191af05100a54b6b8ea80760654f71a06b37c760a65d09e8186e7
SHA512 73d7c39fa54fc2a80225c4dca679afe52a03638cac4ce2fe8d94eee9d588c93e04a170879f1664bfe6d1fe3882e45f344ec50db5af9503bf90db70f5c74ea99a

memory/2708-6-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Windows\SysWOW64\gqndjmhc\dfaricjc.exe

MD5 292ee52256caf3d56ddd8058f65da965
SHA1 c2582581ba17710e79b654a4a8f7da1b0131db68
SHA256 c91a6732ef4d6c974a93ce8d95654028c49e3aee3da5cdb21b7e6991a28a8d5c
SHA512 23562d6c321ef3f90671e10ff4d8149ed423adc10706afdaab4e575e7ce3e8f408c5616fdeb4050bfada8c56e4ced582fb7752d3aa1ce8345ed4cf4d78428eab

memory/1460-8-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1460-9-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2180-11-0x00000000000D0000-0x00000000000E5000-memory.dmp

memory/2180-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2180-14-0x00000000000D0000-0x00000000000E5000-memory.dmp

memory/1460-15-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2180-18-0x00000000000D0000-0x00000000000E5000-memory.dmp

memory/2180-19-0x00000000000D0000-0x00000000000E5000-memory.dmp

memory/2180-20-0x00000000000D0000-0x00000000000E5000-memory.dmp

memory/2180-21-0x00000000000D0000-0x00000000000E5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 09:37

Reported

2024-03-13 09:39

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hrenqitv\ImagePath = "C:\\Windows\\SysWOW64\\hrenqitv\\xwiejtdq.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3720 set thread context of 4492 N/A C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 836 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 836 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 836 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 836 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 836 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 836 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 836 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 836 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 836 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\sc.exe
PID 3720 wrote to memory of 4492 N/A C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe C:\Windows\SysWOW64\svchost.exe
PID 3720 wrote to memory of 4492 N/A C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe C:\Windows\SysWOW64\svchost.exe
PID 3720 wrote to memory of 4492 N/A C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe C:\Windows\SysWOW64\svchost.exe
PID 3720 wrote to memory of 4492 N/A C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe C:\Windows\SysWOW64\svchost.exe
PID 3720 wrote to memory of 4492 N/A C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe C:\Windows\SysWOW64\svchost.exe
PID 836 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\netsh.exe
PID 836 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\netsh.exe
PID 836 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe

"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hrenqitv\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xwiejtdq.exe" C:\Windows\SysWOW64\hrenqitv\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create hrenqitv binPath= "C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe /d\"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description hrenqitv "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start hrenqitv

C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe

C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe /d"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 98.136.96.74:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 209.85.203.26:25 smtp.google.com tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 82.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp

Files

memory/836-0-0x0000000000400000-0x000000000041E000-memory.dmp

memory/836-2-0x0000000000400000-0x000000000041E000-memory.dmp

memory/836-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

memory/836-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xwiejtdq.exe

MD5 103fa56bbbf7f69b1f554acb22b00a56
SHA1 ba9968ad9178a12fcc8233a36b9dc3b28b4ff38a
SHA256 72afe1dce02f63aff5116011cd9f3d3123dee9aef3d870f84e0acb187fef8de4
SHA512 6ddcf83dda09e0358097261a81a94f1460a2b3b914ea2d43ee688e1dc16e3e1686b18fef4a8b025054934af093af062734bda2a9dab3cbd5acdb1f6dcc55418f

memory/3720-7-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3720-9-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

memory/4492-10-0x0000000000130000-0x0000000000145000-memory.dmp

memory/3720-11-0x0000000000400000-0x000000000041E000-memory.dmp

memory/836-14-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4492-15-0x0000000000130000-0x0000000000145000-memory.dmp

memory/4492-16-0x0000000000130000-0x0000000000145000-memory.dmp

memory/4492-17-0x0000000000130000-0x0000000000145000-memory.dmp

memory/4492-18-0x0000000000130000-0x0000000000145000-memory.dmp