Malware Analysis Report

2025-04-13 10:35

Sample ID 240326-mdb99sah2x
Target deed33d8537ad5384cd927b88df28494
SHA256 6eaff3a3059d64fba8aaf22757cd51de82addb4f84f24f87aa3292a95d0825ca
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6eaff3a3059d64fba8aaf22757cd51de82addb4f84f24f87aa3292a95d0825ca

Threat Level: Known bad

The file deed33d8537ad5384cd927b88df28494 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Windows security bypass

Tofsee

Sets service image path in registry

Modifies Windows Firewall

Creates new service(s)

Executes dropped EXE

Deletes itself

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in System32 directory

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-26 10:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-26 10:20

Reported

2024-03-26 10:23

Platform

win7-20240221-en

Max time kernel

143s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ymqshkno = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ymqshkno\ImagePath = "C:\\Windows\\SysWOW64\\ymqshkno\\hbbsdmdf.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2428 set thread context of 2992 N/A C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1436 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 1436 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\netsh.exe
PID 1436 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\netsh.exe
PID 1436 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\netsh.exe
PID 1436 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\netsh.exe
PID 2428 wrote to memory of 2992 N/A C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe C:\Windows\SysWOW64\svchost.exe
PID 2428 wrote to memory of 2992 N/A C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe C:\Windows\SysWOW64\svchost.exe
PID 2428 wrote to memory of 2992 N/A C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe C:\Windows\SysWOW64\svchost.exe
PID 2428 wrote to memory of 2992 N/A C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe C:\Windows\SysWOW64\svchost.exe
PID 2428 wrote to memory of 2992 N/A C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe C:\Windows\SysWOW64\svchost.exe
PID 2428 wrote to memory of 2992 N/A C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe

"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ymqshkno\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hbbsdmdf.exe" C:\Windows\SysWOW64\ymqshkno\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create ymqshkno binPath= "C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe /d\"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description ymqshkno "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start ymqshkno

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe

C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe /d"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.204.73:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 142.251.173.27:25 smtp.google.com tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
HK 43.231.4.7:443 tcp

Files

memory/1436-1-0x00000000005A0000-0x00000000006A0000-memory.dmp

memory/1436-4-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1436-3-0x0000000000220000-0x0000000000233000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hbbsdmdf.exe

MD5 99942c7c9d05ab4ceb75ca3880952cc3
SHA1 5bbe60343821535132ec1c0382f34299459c2ded
SHA256 efc7a37e4f2a33a07b9f2bcc223ca6942c9e5ea6dac5fe0d724b0a474c853edc
SHA512 e53013dd7d2abc899a71e8fc620b6675be2685873607182868c2806cc753eb355e850190ffe0c81e6293987a96d3eb68d0f5a26c7f7ef7f29f60957052e00a60

memory/1436-6-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe

MD5 d3518cfce049a078c5d7d454f45f18ff
SHA1 c9a2a92a0d093fbe96fa331ad6f0187de278fadc
SHA256 a994d077bddd69c283ac3df4688089118696dc22f994dc368a59e610651695fa
SHA512 36cd6fe78146d0a11c0192413c0b358de2080ffd28aa602f339fb153bacc9cbbcf8428d0cd5ffac353a995715899b7c40dc5b0d9e17c91663a8206b2d2f6a86e

memory/2428-9-0x00000000004E0000-0x00000000005E0000-memory.dmp

memory/2428-10-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2992-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2992-11-0x0000000000100000-0x0000000000115000-memory.dmp

memory/2428-15-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2992-14-0x0000000000100000-0x0000000000115000-memory.dmp

memory/2992-18-0x0000000000100000-0x0000000000115000-memory.dmp

memory/2992-19-0x0000000000100000-0x0000000000115000-memory.dmp

memory/2992-20-0x0000000000100000-0x0000000000115000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-26 10:20

Reported

2024-03-26 10:23

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lylhnhqf\ImagePath = "C:\\Windows\\SysWOW64\\lylhnhqf\\tvqwpcm.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\|xr C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe N/A
File created C:\Windows\SysWOW64\ΓΌ?q C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4708 set thread context of 524 N/A C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4260 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4260 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4260 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4260 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4260 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4260 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4260 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4260 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4260 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\sc.exe
PID 4708 wrote to memory of 524 N/A C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe C:\Windows\SysWOW64\svchost.exe
PID 4708 wrote to memory of 524 N/A C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe C:\Windows\SysWOW64\svchost.exe
PID 4708 wrote to memory of 524 N/A C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe C:\Windows\SysWOW64\svchost.exe
PID 4708 wrote to memory of 524 N/A C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe C:\Windows\SysWOW64\svchost.exe
PID 4708 wrote to memory of 524 N/A C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe C:\Windows\SysWOW64\svchost.exe
PID 4260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\netsh.exe
PID 4260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\netsh.exe
PID 4260 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe

"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lylhnhqf\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tvqwpcm.exe" C:\Windows\SysWOW64\lylhnhqf\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create lylhnhqf binPath= "C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe /d\"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description lylhnhqf "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start lylhnhqf

C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe

C:\Windows\SysWOW64\lylhnhqf\tvqwpcm.exe /d"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4260 -ip 4260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4708 -ip 4708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 1044

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 57.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.228.111:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 142.251.173.27:25 smtp.google.com tcp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp

Files

memory/4260-1-0x00000000004D0000-0x00000000005D0000-memory.dmp

memory/4260-2-0x00000000004B0000-0x00000000004C3000-memory.dmp

memory/4260-3-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tvqwpcm.exe

MD5 d1c78fcfbc3a5262649e77cff98be43d
SHA1 5ef136647957980055ae386066deeac7cafcfcd8
SHA256 5f66c0b1051813c566fdf24230ea6a26c285897611f8e32d20c630e0f78f660e
SHA512 64850b4faea01258989ea6dc90b8450f81a9a1681623013e682e0a3d7348c939d12d497eece34b0d4275c3859ea49ba33bb7d3c90351da5b94bde45b810ace63

memory/4708-8-0x0000000000700000-0x0000000000800000-memory.dmp

memory/4708-10-0x00000000006C0000-0x00000000006D3000-memory.dmp

memory/524-9-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

memory/4708-12-0x0000000000400000-0x000000000046E000-memory.dmp

memory/524-14-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

memory/4260-16-0x0000000000400000-0x000000000046E000-memory.dmp

memory/524-17-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

memory/524-18-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

memory/524-19-0x0000000000BE0000-0x0000000000BF5000-memory.dmp