Malware Analysis Report

2025-04-13 10:35

Sample ID 240325-sf66baeb9z
Target de4b82a7ffeafcc4720ea974858808fd
SHA256 ef25242cd655ccffe910bec6a1625773d929fb0bc657a8af0a72442af126c7b1
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ef25242cd655ccffe910bec6a1625773d929fb0bc657a8af0a72442af126c7b1

Threat Level: Known bad

The file de4b82a7ffeafcc4720ea974858808fd was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Windows security bypass

Sets service image path in registry

Modifies Windows Firewall

Creates new service(s)

Deletes itself

Executes dropped EXE

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-25 15:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-25 15:05

Reported

2024-03-25 15:07

Platform

win7-20240221-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\osywdkhm = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\osywdkhm\ImagePath = "C:\\Windows\\SysWOW64\\osywdkhm\\lpwacfvh.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2052 set thread context of 2540 N/A C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3020 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3020 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\netsh.exe
PID 3020 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\netsh.exe
PID 3020 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\netsh.exe
PID 3020 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\netsh.exe
PID 2052 wrote to memory of 2540 N/A C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 2540 N/A C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 2540 N/A C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 2540 N/A C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 2540 N/A C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe C:\Windows\SysWOW64\svchost.exe
PID 2052 wrote to memory of 2540 N/A C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe

"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\osywdkhm\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lpwacfvh.exe" C:\Windows\SysWOW64\osywdkhm\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create osywdkhm binPath= "C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe /d\"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description osywdkhm "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start osywdkhm

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe

C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe /d"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.204.72:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 142.250.110.27:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/3020-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

memory/3020-2-0x0000000000220000-0x0000000000233000-memory.dmp

memory/3020-3-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lpwacfvh.exe

MD5 edf29686701f2c850340d956b4f7b241
SHA1 c82e4490add55ccde7a12229d0c61e9cb77c9eaa
SHA256 54044a0551c1f5810cdd6dd371855890d0478bbe4f652d54c1452d33781b3647
SHA512 7c7d6436d3f69861bb2697314951498aa685e132601fd21c100f105ceda527b19abb552da4e55b02de788d3aab802061c3d8c36e4cfa5a644aaef8a9be0dbcd5

memory/3020-6-0x0000000000400000-0x000000000046E000-memory.dmp

memory/3020-7-0x0000000000220000-0x0000000000233000-memory.dmp

C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe

MD5 dfdfcbc34afa9d39dbe423373d6f83aa
SHA1 b7dcea60759e86e7e3f41508643099a98d4bec41
SHA256 2c724ed03fdfe4c9617d57b3d49875fac92c4c22c8c14da39bfcb06e7045795e
SHA512 00315a14d7e3326097abe6e9b2ada52ad3cd1a518584891f41825480f23a50b71d103f616b4a7535a9bd8abfa5cde01106e470d9a642dd1c6d1fbc930c65caa6

memory/2052-10-0x0000000000530000-0x0000000000630000-memory.dmp

memory/2052-11-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2540-12-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2540-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2540-15-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2052-17-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2540-20-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2540-21-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2540-22-0x00000000000C0000-0x00000000000D5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-25 15:05

Reported

2024-03-25 15:07

Platform

win10v2004-20240319-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\usiuxfcn\ImagePath = "C:\\Windows\\SysWOW64\\usiuxfcn\\ziuakfbr.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4608 set thread context of 4936 N/A C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3644 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3644 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3644 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3644 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3644 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3644 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\cmd.exe
PID 3644 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\sc.exe
PID 3644 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\netsh.exe
PID 3644 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\netsh.exe
PID 3644 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe C:\Windows\SysWOW64\netsh.exe
PID 4608 wrote to memory of 4936 N/A C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 4936 N/A C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 4936 N/A C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 4936 N/A C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 4936 N/A C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe

"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\usiuxfcn\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ziuakfbr.exe" C:\Windows\SysWOW64\usiuxfcn\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create usiuxfcn binPath= "C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe /d\"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description usiuxfcn "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start usiuxfcn

C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe

C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe /d"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 98.136.96.75:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 142.250.110.26:25 smtp.google.com tcp
US 8.8.8.8:53 43.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

memory/3644-1-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/3644-2-0x00000000004F0000-0x0000000000503000-memory.dmp

memory/3644-3-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ziuakfbr.exe

MD5 f08a9951342f5405aef3495d71494081
SHA1 80ca74618df12621d393e49da5082b9f054e5b0d
SHA256 334b712b6dc2157607eb44a7c97cb4ba46d16bcb8a51110995c930207e87d73d
SHA512 5eef7ed61e3c0870166a0def5f10e88cbe69ebdf7e41eba1557f399ae38b3c95ba4cf0b9f2050be9ff8dbb5f826878f84c9cc77b4551139e66826502974e40b3

C:\Windows\SysWOW64\usiuxfcn\ziuakfbr.exe

MD5 5a66bc2084b6210e4bd1efb1eb1136f4
SHA1 1a6250b455f06043ea680e0cd50805fcabc2aaff
SHA256 ee1cce5b18d65851138dee09b02fb637cdd0f7fc6cd1d2059bf59da0e79aee23
SHA512 6b18c0634affeff40d97be395806ff87f46558dd40334b2d69514b8dfc4c54f2e590a34e76488e5b51a7ea7d5f38559ef6ed0d31f5e8c5b8e6a524142cd98b38

memory/4608-8-0x0000000000770000-0x0000000000870000-memory.dmp

memory/4608-9-0x0000000000400000-0x000000000046E000-memory.dmp

memory/4936-10-0x0000000000F10000-0x0000000000F25000-memory.dmp

memory/4936-13-0x0000000000F10000-0x0000000000F25000-memory.dmp

memory/3644-14-0x0000000000400000-0x000000000046E000-memory.dmp

memory/4936-15-0x0000000000F10000-0x0000000000F25000-memory.dmp

memory/4936-16-0x0000000000F10000-0x0000000000F25000-memory.dmp

memory/4608-18-0x0000000000400000-0x000000000046E000-memory.dmp

memory/4608-22-0x00000000006D0000-0x00000000006E3000-memory.dmp

memory/3644-24-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/4936-26-0x0000000000F10000-0x0000000000F25000-memory.dmp