Malware Analysis Report

2024-10-23 16:28

Sample ID 240415-whg6raeg71
Target f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118
SHA256 87140618703529cf84c6e119ecde2b6faeabba17cd73a817ee17856b2692bb70
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

87140618703529cf84c6e119ecde2b6faeabba17cd73a817ee17856b2692bb70

Threat Level: Known bad

The file f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Modifies Windows Firewall

Sets service image path in registry

Creates new service(s)

Executes dropped EXE

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-15 17:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-15 17:55

Reported

2024-04-15 17:57

Platform

win7-20240221-en

Max time kernel

147s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1664 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1664 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1664 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1664 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1664 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2536 wrote to memory of 2364 N/A C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe C:\Windows\SysWOW64\svchost.exe
PID 2536 wrote to memory of 2364 N/A C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe C:\Windows\SysWOW64\svchost.exe
PID 2536 wrote to memory of 2364 N/A C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe C:\Windows\SysWOW64\svchost.exe
PID 2536 wrote to memory of 2364 N/A C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe C:\Windows\SysWOW64\svchost.exe
PID 2536 wrote to memory of 2364 N/A C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xtcdfzlq\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lypyqdfz.exe" C:\Windows\SysWOW64\xtcdfzlq\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create xtcdfzlq binPath= "C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe /d\"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description xtcdfzlq "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start xtcdfzlq

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe

C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe /d"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

N/A

Files

memory/1664-1-0x0000000000250000-0x0000000000350000-memory.dmp

memory/1664-2-0x00000000003C0000-0x00000000003D3000-memory.dmp

memory/1664-4-0x0000000000400000-0x00000000023AD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lypyqdfz.exe

MD5 702a8c82b7c7bb11b56695e1059ecc46
SHA1 d662ad72e5a93d334d057291d06d12c8fb819199
SHA256 6c3e68d8f3952daa0093b672b61ddb809756324127d40243fc25a9d82099b13c
SHA512 83378d61fdca534d9aa5a895be181f39e8a5c79c911edb18663e7dfeb4281f32f3b3c361a9d3ad00013187abf019255737323cf412982b1d3b5827f5ff3ccd76

memory/1664-6-0x0000000000400000-0x00000000023AD000-memory.dmp

memory/1664-9-0x00000000003C0000-0x00000000003D3000-memory.dmp

memory/2536-10-0x0000000002530000-0x0000000002630000-memory.dmp

memory/2364-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2364-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2536-14-0x0000000000400000-0x00000000023AD000-memory.dmp

memory/2536-17-0x0000000002530000-0x0000000002630000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-15 17:55

Reported

2024-04-15 17:57

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rpdydnxe\ImagePath = "C:\\Windows\\SysWOW64\\rpdydnxe\\vvobnkjl.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2100 set thread context of 3744 N/A C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4504 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4504 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 4504 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 4504 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2100 wrote to memory of 3744 N/A C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe C:\Windows\SysWOW64\svchost.exe
PID 2100 wrote to memory of 3744 N/A C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe C:\Windows\SysWOW64\svchost.exe
PID 2100 wrote to memory of 3744 N/A C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe C:\Windows\SysWOW64\svchost.exe
PID 2100 wrote to memory of 3744 N/A C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe C:\Windows\SysWOW64\svchost.exe
PID 2100 wrote to memory of 3744 N/A C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rpdydnxe\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vvobnkjl.exe" C:\Windows\SysWOW64\rpdydnxe\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create rpdydnxe binPath= "C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe /d\"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description rpdydnxe "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start rpdydnxe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe

C:\Windows\SysWOW64\rpdydnxe\vvobnkjl.exe /d"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2100 -ip 2100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 18.129.101.95.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.8.49:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.204.73:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 173.194.79.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.187.202:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/4504-1-0x00000000023F0000-0x00000000024F0000-memory.dmp

memory/4504-2-0x00000000040F0000-0x0000000004103000-memory.dmp

memory/4504-4-0x0000000000400000-0x00000000023AD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vvobnkjl.exe

MD5 82e20f8d817f417fa627bac370bb73e2
SHA1 a9780f4880e6fa06b7c5fddf900b9549163b81d9
SHA256 1e7636012b67b7dfdaf2637d1b607caf2dd2306ee02d6ce09bd20911712c80a1
SHA512 0a33d53be9723edaf1f71a7e29bdd4d67fd71a0dd1ad5b002fbba1a10e7196033db4ca29b7ac7377c97af189f3ac63b33b45635a0ee137372f789b98f06ed85f

memory/4504-6-0x0000000000400000-0x00000000023AD000-memory.dmp

memory/4504-7-0x0000000000400000-0x00000000023AD000-memory.dmp

memory/4504-8-0x00000000040F0000-0x0000000004103000-memory.dmp

memory/2100-11-0x0000000002510000-0x0000000002610000-memory.dmp

memory/3744-12-0x0000000000E70000-0x0000000000E85000-memory.dmp

memory/3744-15-0x0000000000E70000-0x0000000000E85000-memory.dmp

memory/2100-16-0x0000000000400000-0x00000000023AD000-memory.dmp

memory/3744-17-0x0000000000E70000-0x0000000000E85000-memory.dmp

memory/3744-18-0x0000000000E70000-0x0000000000E85000-memory.dmp

memory/2100-19-0x0000000000400000-0x00000000023AD000-memory.dmp

memory/3744-20-0x0000000000E70000-0x0000000000E85000-memory.dmp