Malware Analysis Report

2025-06-16 05:08

Sample ID 240313-lnx42sca45
Target c58c41fb9de90f13223980a5147fdf71
SHA256 f1698aadacb8433276f1e225a8c00f0311d6bb2b721e40e2f88e4fecc3d6cd3e
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f1698aadacb8433276f1e225a8c00f0311d6bb2b721e40e2f88e4fecc3d6cd3e

Threat Level: Known bad

The file c58c41fb9de90f13223980a5147fdf71 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Windows security bypass

Creates new service(s)

Sets service image path in registry

Modifies Windows Firewall

Checks computer location settings

Deletes itself

Executes dropped EXE

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 09:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 09:41

Reported

2024-03-13 09:43

Platform

win7-20240221-en

Max time kernel

145s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\hhmdterx = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\hhmdterx\ImagePath = "C:\\Windows\\SysWOW64\\hhmdterx\\jgzopasf.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2784 set thread context of 2700 N/A C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2884 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 2884 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\netsh.exe
PID 2884 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\netsh.exe
PID 2884 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\netsh.exe
PID 2884 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\netsh.exe
PID 2784 wrote to memory of 2700 N/A C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2700 N/A C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2700 N/A C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2700 N/A C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2700 N/A C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2700 N/A C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe

"C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hhmdterx\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jgzopasf.exe" C:\Windows\SysWOW64\hhmdterx\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create hhmdterx binPath= "C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe /d\"C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description hhmdterx "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start hhmdterx

C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe

C:\Windows\SysWOW64\hhmdterx\jgzopasf.exe /d"C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
RU 176.111.174.19:443 tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.94:25 mta6.am0.yahoodns.net tcp
RU 176.111.174.19:443 tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 209.85.203.27:25 smtp.google.com tcp
RU 176.111.174.19:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
RU 176.111.174.19:443 tcp
RU 176.111.174.19:443 tcp

Files

memory/2884-3-0x00000000001B0000-0x00000000001C3000-memory.dmp

memory/2884-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

memory/2884-4-0x0000000000400000-0x000000000099D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jgzopasf.exe

MD5 2529655477b4192aae0f3f034a999a0a
SHA1 d6d6e8f5550d79995d6d5de6618c375a0aff57e5
SHA256 aff3d242ddc20be5b26dfb3d0ea4445bfca0fc67dd7a0c4dfc9f95b0aa7abcb6
SHA512 d2d5291c5578ed10278d3c60819e3753a7d2d7ba02650e9d25fd2b2f4842a9adcd573f56d7b3c2f0c43894b77564d80ef9fa11a83664b14992513e57de2d7fe5

memory/2884-8-0x0000000000400000-0x000000000099D000-memory.dmp

memory/2784-9-0x0000000000A80000-0x0000000000B80000-memory.dmp

memory/2700-13-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2700-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2784-15-0x0000000000400000-0x000000000099D000-memory.dmp

memory/2784-17-0x0000000000400000-0x000000000099D000-memory.dmp

memory/2700-18-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2700-10-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2700-19-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2700-20-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 09:41

Reported

2024-03-13 09:43

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\kpempfxh\ImagePath = "C:\\Windows\\SysWOW64\\kpempfxh\\doftbivs.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\kpempfxh\doftbivs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3120 set thread context of 4532 N/A C:\Windows\SysWOW64\kpempfxh\doftbivs.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1116 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\sc.exe
PID 1116 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\netsh.exe
PID 1116 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\netsh.exe
PID 1116 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe C:\Windows\SysWOW64\netsh.exe
PID 3120 wrote to memory of 4532 N/A C:\Windows\SysWOW64\kpempfxh\doftbivs.exe C:\Windows\SysWOW64\svchost.exe
PID 3120 wrote to memory of 4532 N/A C:\Windows\SysWOW64\kpempfxh\doftbivs.exe C:\Windows\SysWOW64\svchost.exe
PID 3120 wrote to memory of 4532 N/A C:\Windows\SysWOW64\kpempfxh\doftbivs.exe C:\Windows\SysWOW64\svchost.exe
PID 3120 wrote to memory of 4532 N/A C:\Windows\SysWOW64\kpempfxh\doftbivs.exe C:\Windows\SysWOW64\svchost.exe
PID 3120 wrote to memory of 4532 N/A C:\Windows\SysWOW64\kpempfxh\doftbivs.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe

"C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kpempfxh\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\doftbivs.exe" C:\Windows\SysWOW64\kpempfxh\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create kpempfxh binPath= "C:\Windows\SysWOW64\kpempfxh\doftbivs.exe /d\"C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description kpempfxh "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start kpempfxh

C:\Windows\SysWOW64\kpempfxh\doftbivs.exe

C:\Windows\SysWOW64\kpempfxh\doftbivs.exe /d"C:\Users\Admin\AppData\Local\Temp\c58c41fb9de90f13223980a5147fdf71.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1116 -ip 1116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 1028

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3120 -ip 3120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 524

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
RU 176.111.174.19:443 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.106:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 33.134.221.88.in-addr.arpa udp
RU 176.111.174.19:443 tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 209.85.203.27:25 smtp.google.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
RU 176.111.174.19:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
RU 176.111.174.19:443 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
RU 176.111.174.19:443 tcp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

memory/1116-1-0x0000000000C70000-0x0000000000D70000-memory.dmp

memory/1116-2-0x0000000000C40000-0x0000000000C53000-memory.dmp

memory/1116-4-0x0000000000400000-0x000000000099D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\doftbivs.exe

MD5 ad4de3e5bdd83cedd504f1009e578c1f
SHA1 8a87a2bb98184280b2b23dd0be99e0c65368e6f2
SHA256 bd8a4bc43c392917f3f9707418acb402bd68ad9bf814d62480463472dde16138
SHA512 aea5a63870a4b24b973b41fca0e64829c3ffc1368bd678c7b73fa58d752451e639e349d5f644389cd8368eee68e58f5f90d49e6b83c9c802071fc7d23048010d

memory/1116-8-0x0000000000400000-0x000000000099D000-memory.dmp

memory/1116-9-0x0000000000C40000-0x0000000000C53000-memory.dmp

memory/3120-10-0x0000000000B80000-0x0000000000C80000-memory.dmp

memory/3120-11-0x0000000000400000-0x000000000099D000-memory.dmp

memory/4532-12-0x0000000000740000-0x0000000000755000-memory.dmp

memory/4532-15-0x0000000000740000-0x0000000000755000-memory.dmp

memory/4532-16-0x0000000000740000-0x0000000000755000-memory.dmp

memory/3120-17-0x0000000000400000-0x000000000099D000-memory.dmp

memory/4532-18-0x0000000000740000-0x0000000000755000-memory.dmp