Malware Analysis Report

2025-04-13 10:35

Sample ID 240326-v9qrjafg99
Target dfbd4be3187891db496fee51595274f1
SHA256 76782ff9477534ad7cdd3235749e7c508174042c9300c136291b8cdee3338544
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

76782ff9477534ad7cdd3235749e7c508174042c9300c136291b8cdee3338544

Threat Level: Known bad

The file dfbd4be3187891db496fee51595274f1 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Windows security bypass

Tofsee

Creates new service(s)

Modifies Windows Firewall

Sets service image path in registry

Executes dropped EXE

Deletes itself

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-26 17:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-26 17:41

Reported

2024-03-26 17:44

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dlxntsca\ImagePath = "C:\\Windows\\SysWOW64\\dlxntsca\\pggzpopd.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 404 set thread context of 4612 N/A C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3468 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 3468 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\netsh.exe
PID 3468 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\netsh.exe
PID 3468 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\netsh.exe
PID 404 wrote to memory of 4612 N/A C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe C:\Windows\SysWOW64\svchost.exe
PID 404 wrote to memory of 4612 N/A C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe C:\Windows\SysWOW64\svchost.exe
PID 404 wrote to memory of 4612 N/A C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe C:\Windows\SysWOW64\svchost.exe
PID 404 wrote to memory of 4612 N/A C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe C:\Windows\SysWOW64\svchost.exe
PID 404 wrote to memory of 4612 N/A C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe

"C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dlxntsca\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pggzpopd.exe" C:\Windows\SysWOW64\dlxntsca\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create dlxntsca binPath= "C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe /d\"C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description dlxntsca "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start dlxntsca

C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe

C:\Windows\SysWOW64\dlxntsca\pggzpopd.exe /d"C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3468 -ip 3468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1036

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 404 -ip 404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 89.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.187.202:443 chromewebstore.googleapis.com tcp
GB 142.250.187.202:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.204.77:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 73.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 64.233.167.26:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/3468-1-0x0000000002EC0000-0x0000000002FC0000-memory.dmp

memory/3468-2-0x0000000002E60000-0x0000000002E73000-memory.dmp

memory/3468-4-0x0000000000400000-0x0000000002CB9000-memory.dmp

memory/3468-5-0x0000000000400000-0x0000000002CB9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pggzpopd.exe

MD5 340b4d9596abb7a55bb99f10ab1bedf3
SHA1 ebd657e7b9a02b95fe4c70c7b68dde5b101e984c
SHA256 d3b91a31a2c61f632ec87613c61b5440ddb70c41a60669294bd1514113f848a3
SHA512 2796354c759b9ef9ddd461136a3c6af473914fac023400a4b0808c77fe3369fdf9cbb9e9b470057a3f562f1248156f7cb54a8dd6ec8bdaa01f39678ec5f9bd0f

memory/3468-9-0x0000000000400000-0x0000000002CB9000-memory.dmp

memory/3468-10-0x0000000002E60000-0x0000000002E73000-memory.dmp

memory/4612-12-0x00000000003B0000-0x00000000003C5000-memory.dmp

memory/4612-13-0x00000000003B0000-0x00000000003C5000-memory.dmp

memory/404-11-0x0000000000400000-0x0000000002CB9000-memory.dmp

memory/404-14-0x0000000002EA0000-0x0000000002FA0000-memory.dmp

memory/4612-16-0x00000000003B0000-0x00000000003C5000-memory.dmp

memory/404-17-0x0000000000400000-0x0000000002CB9000-memory.dmp

memory/4612-18-0x00000000003B0000-0x00000000003C5000-memory.dmp

memory/4612-19-0x00000000003B0000-0x00000000003C5000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-26 17:41

Reported

2024-03-26 17:44

Platform

win7-20240221-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\vjzwfnmt = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vjzwfnmt\ImagePath = "C:\\Windows\\SysWOW64\\vjzwfnmt\\uurmpgxp.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2572 set thread context of 2448 N/A C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1224 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\sc.exe
PID 1224 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\netsh.exe
PID 1224 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\netsh.exe
PID 1224 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\netsh.exe
PID 1224 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe C:\Windows\SysWOW64\netsh.exe
PID 2572 wrote to memory of 2448 N/A C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe C:\Windows\SysWOW64\svchost.exe
PID 2572 wrote to memory of 2448 N/A C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe C:\Windows\SysWOW64\svchost.exe
PID 2572 wrote to memory of 2448 N/A C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe C:\Windows\SysWOW64\svchost.exe
PID 2572 wrote to memory of 2448 N/A C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe C:\Windows\SysWOW64\svchost.exe
PID 2572 wrote to memory of 2448 N/A C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe C:\Windows\SysWOW64\svchost.exe
PID 2572 wrote to memory of 2448 N/A C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe

"C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vjzwfnmt\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\uurmpgxp.exe" C:\Windows\SysWOW64\vjzwfnmt\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create vjzwfnmt binPath= "C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe /d\"C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description vjzwfnmt "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start vjzwfnmt

C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe

C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe /d"C:\Users\Admin\AppData\Local\Temp\dfbd4be3187891db496fee51595274f1.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.109:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 64.233.167.27:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/1224-2-0x0000000000230000-0x0000000000243000-memory.dmp

memory/1224-1-0x0000000002E20000-0x0000000002F20000-memory.dmp

memory/1224-4-0x0000000000400000-0x0000000002CB9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uurmpgxp.exe

MD5 9daafea02806921d1e1e349c2f74ab76
SHA1 3580329ddd7ec73dfe6817dcf157b8d8dca25b94
SHA256 bab7e35eeb1be6d440da7b2ee85435f716c17a15b84e769a6f32115d8d432c62
SHA512 9eda89259d6442add677d43ecc9f606afbf18aefffa5f44b1c837e3736885ed299ec32048327402017e36a7a07d8438121bae1fa591b2f98a07bf3efee0dee0d

C:\Windows\SysWOW64\vjzwfnmt\uurmpgxp.exe

MD5 9fb67a9d11d940db577ea05d08f315d0
SHA1 4abedf1b21aa4afe7240fcd1c0e2c5908796da92
SHA256 7e6d17084aa95217ddd11dbda9db15476bb478781f453451bd384c10c9889c07
SHA512 91039a0678d635bacaafac23ace674e7d6fd3d6ea6b3b70e05661e2d3c22246efd14bc8fa1a91a614e5aecc9d20fe98060c0d7c25928786913038275ce8fb587

memory/1224-8-0x0000000000400000-0x0000000002CB9000-memory.dmp

memory/1224-9-0x0000000002E20000-0x0000000002F20000-memory.dmp

memory/2572-10-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

memory/2448-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2448-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2448-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2572-15-0x0000000000400000-0x0000000002CB9000-memory.dmp

memory/2448-19-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2448-20-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2572-17-0x0000000000400000-0x0000000002CB9000-memory.dmp

memory/2448-21-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2448-22-0x0000000000080000-0x0000000000095000-memory.dmp