Malware Analysis Report

2025-04-13 10:35

Sample ID 240325-s76nvscb67
Target de5f0b876145c3072389c0af52539a06
SHA256 fbc03327661ed973c859257eb8ad4941108669c968de30a2ef77af775fe0e960
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fbc03327661ed973c859257eb8ad4941108669c968de30a2ef77af775fe0e960

Threat Level: Known bad

The file de5f0b876145c3072389c0af52539a06 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Windows security bypass

Tofsee

Sets service image path in registry

Modifies Windows Firewall

Creates new service(s)

Checks computer location settings

Executes dropped EXE

Deletes itself

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-25 15:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-25 15:47

Reported

2024-03-25 15:49

Platform

win7-20240215-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\mfnklunj = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mfnklunj\ImagePath = "C:\\Windows\\SysWOW64\\mfnklunj\\veuijxms.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mfnklunj\veuijxms.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2756 set thread context of 2464 N/A C:\Windows\SysWOW64\mfnklunj\veuijxms.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2328 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 2328 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\netsh.exe
PID 2328 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\netsh.exe
PID 2328 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\netsh.exe
PID 2328 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\netsh.exe
PID 2756 wrote to memory of 2464 N/A C:\Windows\SysWOW64\mfnklunj\veuijxms.exe C:\Windows\SysWOW64\svchost.exe
PID 2756 wrote to memory of 2464 N/A C:\Windows\SysWOW64\mfnklunj\veuijxms.exe C:\Windows\SysWOW64\svchost.exe
PID 2756 wrote to memory of 2464 N/A C:\Windows\SysWOW64\mfnklunj\veuijxms.exe C:\Windows\SysWOW64\svchost.exe
PID 2756 wrote to memory of 2464 N/A C:\Windows\SysWOW64\mfnklunj\veuijxms.exe C:\Windows\SysWOW64\svchost.exe
PID 2756 wrote to memory of 2464 N/A C:\Windows\SysWOW64\mfnklunj\veuijxms.exe C:\Windows\SysWOW64\svchost.exe
PID 2756 wrote to memory of 2464 N/A C:\Windows\SysWOW64\mfnklunj\veuijxms.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe

"C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mfnklunj\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\veuijxms.exe" C:\Windows\SysWOW64\mfnklunj\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create mfnklunj binPath= "C:\Windows\SysWOW64\mfnklunj\veuijxms.exe /d\"C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description mfnklunj "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start mfnklunj

C:\Windows\SysWOW64\mfnklunj\veuijxms.exe

C:\Windows\SysWOW64\mfnklunj\veuijxms.exe /d"C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.228.94:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 142.250.110.26:25 smtp.google.com tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp

Files

memory/2328-3-0x0000000000220000-0x0000000000233000-memory.dmp

memory/2328-1-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

memory/2328-4-0x0000000000400000-0x0000000002C68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\veuijxms.exe

MD5 9e47bbde4eb2bcd36749bd71b6cdb3fd
SHA1 49761226378ac20a28b6bc0db9677836226c2ea4
SHA256 763f2ff2fc525efeaa5b12b3eb5d0ae50dcd3d040f59c8d0898b94cfb7bdad9f
SHA512 ef0e1a4b817e1700f70997383176c22f43d8fe29f922e7b326a5ce6ff9e699099ee6ed19474b3557c8aec2b817a238e2147fb314937587bb9c14ad7b99263b55

C:\Windows\SysWOW64\mfnklunj\veuijxms.exe

MD5 133f6ccff654ab3c26c8b1cc0d0d2fd8
SHA1 9b65290ae3f5447511c76fa413a0de7381ba3869
SHA256 11c2e9126ff4d05d9adf6d3ba62fc71b07bf21a234e1f2abfa1529b85495e6fc
SHA512 92fc259383d86a37a8c7100d06fd316ca6bacfdab2e3757a6bcb93047492b49c14adeae6ceacd85f5c1be088b057b4033910d20f4582a2e3e0ff32e6e439f262

memory/2328-8-0x0000000000400000-0x0000000002C68000-memory.dmp

memory/2464-12-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2464-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2464-9-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2756-14-0x0000000002D90000-0x0000000002E90000-memory.dmp

memory/2756-17-0x0000000000400000-0x0000000002C68000-memory.dmp

memory/2464-19-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2464-20-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2464-21-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-25 15:47

Reported

2024-03-25 15:49

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\deroavu\ImagePath = "C:\\Windows\\SysWOW64\\deroavu\\jeorfqqy.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\deroavu\jeorfqqy.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4060 set thread context of 3264 N/A C:\Windows\SysWOW64\deroavu\jeorfqqy.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1656 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 1656 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 1656 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 1656 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 1656 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 1656 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\cmd.exe
PID 1656 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\sc.exe
PID 1656 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\netsh.exe
PID 1656 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\netsh.exe
PID 1656 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe C:\Windows\SysWOW64\netsh.exe
PID 4060 wrote to memory of 3264 N/A C:\Windows\SysWOW64\deroavu\jeorfqqy.exe C:\Windows\SysWOW64\svchost.exe
PID 4060 wrote to memory of 3264 N/A C:\Windows\SysWOW64\deroavu\jeorfqqy.exe C:\Windows\SysWOW64\svchost.exe
PID 4060 wrote to memory of 3264 N/A C:\Windows\SysWOW64\deroavu\jeorfqqy.exe C:\Windows\SysWOW64\svchost.exe
PID 4060 wrote to memory of 3264 N/A C:\Windows\SysWOW64\deroavu\jeorfqqy.exe C:\Windows\SysWOW64\svchost.exe
PID 4060 wrote to memory of 3264 N/A C:\Windows\SysWOW64\deroavu\jeorfqqy.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe

"C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\deroavu\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jeorfqqy.exe" C:\Windows\SysWOW64\deroavu\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create deroavu binPath= "C:\Windows\SysWOW64\deroavu\jeorfqqy.exe /d\"C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description deroavu "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start deroavu

C:\Windows\SysWOW64\deroavu\jeorfqqy.exe

C:\Windows\SysWOW64\deroavu\jeorfqqy.exe /d"C:\Users\Admin\AppData\Local\Temp\de5f0b876145c3072389c0af52539a06.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1656 -ip 1656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1292

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4060 -ip 4060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 544

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.54.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 195.177.78.104.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.204.72:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 64.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 142.250.110.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 203.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/1656-1-0x0000000002D90000-0x0000000002E90000-memory.dmp

memory/1656-2-0x00000000049B0000-0x00000000049C3000-memory.dmp

memory/1656-4-0x0000000000400000-0x0000000002C68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jeorfqqy.exe

MD5 ba0f71e13281a5ccc970321bffc92113
SHA1 8e1e294a319ae8073ced26632f18f8bc00fb5d51
SHA256 b42f8f1fa25b94dbf738ef1b63dea163af5c29c0cd4b9f791ee887eeced69344
SHA512 436d83a28668e9c692221994c706905af0bd4866c555f5fcb203681b0e0d0c872958544aacad76e650609ee10080c846a121185462ab301f51dfe39fe40b9737

C:\Windows\SysWOW64\deroavu\jeorfqqy.exe

MD5 26160d8483a6609e372812a558198e0a
SHA1 0b5ebfdce274f72a8e6043b354d7dcae903aec21
SHA256 bd31765268b24c5717361c31462551cfab82a0e9d1ff400afdef5acee824263c
SHA512 9fdcedc7a5b8c734a559e21ac43b91ed09ceb93a28b39ce6f6ecc22f124d921103510dc0b0a8e573aeb45f834c73f645d239a94e34dcccb08f1488a7d19ac434

memory/1656-9-0x00000000049B0000-0x00000000049C3000-memory.dmp

memory/1656-8-0x0000000000400000-0x0000000002C68000-memory.dmp

memory/4060-10-0x0000000002F00000-0x0000000003000000-memory.dmp

memory/3264-11-0x0000000000510000-0x0000000000525000-memory.dmp

memory/4060-14-0x0000000000400000-0x0000000002C68000-memory.dmp

memory/3264-16-0x0000000000510000-0x0000000000525000-memory.dmp

memory/3264-17-0x0000000000510000-0x0000000000525000-memory.dmp

memory/4060-18-0x0000000000400000-0x0000000002C68000-memory.dmp

memory/3264-19-0x0000000000510000-0x0000000000525000-memory.dmp