Malware Analysis Report

2024-10-19 01:53

Sample ID 240416-c5akmshc7w
Target f27e816769871147e4862997714586f5_JaffaCakes118
SHA256 1cb4511945d33d1414e7edf75f28952256df660a4d70e5599d8d0c653a9c44fc
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1cb4511945d33d1414e7edf75f28952256df660a4d70e5599d8d0c653a9c44fc

Threat Level: Known bad

The file f27e816769871147e4862997714586f5_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Windows security bypass

Tofsee

Creates new service(s)

Modifies Windows Firewall

Sets service image path in registry

Executes dropped EXE

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-16 02:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-16 02:39

Reported

2024-04-16 02:41

Platform

win7-20240221-en

Max time kernel

141s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\efwizmqw = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\efwizmqw\ImagePath = "C:\\Windows\\SysWOW64\\efwizmqw\\kmfqxftj.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2552 set thread context of 2388 N/A C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2248 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2248 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2248 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2248 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2248 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2552 wrote to memory of 2388 N/A C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2388 N/A C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2388 N/A C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2388 N/A C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2388 N/A C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe C:\Windows\SysWOW64\svchost.exe
PID 2552 wrote to memory of 2388 N/A C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\efwizmqw\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kmfqxftj.exe" C:\Windows\SysWOW64\efwizmqw\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create efwizmqw binPath= "C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe /d\"C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description efwizmqw "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start efwizmqw

C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe

C:\Windows\SysWOW64\efwizmqw\kmfqxftj.exe /d"C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 98.136.96.76:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 173.194.79.26:25 smtp.google.com tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
HK 43.231.4.7:443 tcp

Files

memory/2248-1-0x00000000041D0000-0x00000000042D0000-memory.dmp

memory/2248-2-0x0000000000020000-0x0000000000033000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kmfqxftj.exe

MD5 18b0b5022e8d46dfaf4e3ca2cfe38cf9
SHA1 68352345d0d5fcb6f88ab55f466a09af64f070d7
SHA256 82c3601dd9c525a0b07a0417d2169dd7c790d03793b5bba5c8d2312ba6323514
SHA512 1df492259bbc71964f9adcc0227023106b7870431aaa098a889b3ca68c05dd8c50e3c03e5562678705a8da1f20b6caa8f96be90e49fa429785dd26c6d87f1c18

memory/2248-6-0x0000000000400000-0x00000000040F8000-memory.dmp

memory/2552-8-0x00000000041B0000-0x00000000042B0000-memory.dmp

memory/2388-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2388-12-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2388-9-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2388-17-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2552-14-0x0000000000400000-0x00000000040F8000-memory.dmp

memory/2388-18-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2388-19-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-16 02:39

Reported

2024-04-16 02:41

Platform

win10v2004-20240412-en

Max time kernel

145s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\teichouo\ImagePath = "C:\\Windows\\SysWOW64\\teichouo\\bsovmlpt.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\teichouo\bsovmlpt.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2444 set thread context of 3860 N/A C:\Windows\SysWOW64\teichouo\bsovmlpt.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3728 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3728 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3728 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3728 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3728 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3728 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3728 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3728 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3728 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3728 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2444 wrote to memory of 3860 N/A C:\Windows\SysWOW64\teichouo\bsovmlpt.exe C:\Windows\SysWOW64\svchost.exe
PID 2444 wrote to memory of 3860 N/A C:\Windows\SysWOW64\teichouo\bsovmlpt.exe C:\Windows\SysWOW64\svchost.exe
PID 2444 wrote to memory of 3860 N/A C:\Windows\SysWOW64\teichouo\bsovmlpt.exe C:\Windows\SysWOW64\svchost.exe
PID 2444 wrote to memory of 3860 N/A C:\Windows\SysWOW64\teichouo\bsovmlpt.exe C:\Windows\SysWOW64\svchost.exe
PID 2444 wrote to memory of 3860 N/A C:\Windows\SysWOW64\teichouo\bsovmlpt.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\teichouo\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bsovmlpt.exe" C:\Windows\SysWOW64\teichouo\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create teichouo binPath= "C:\Windows\SysWOW64\teichouo\bsovmlpt.exe /d\"C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description teichouo "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start teichouo

C:\Windows\SysWOW64\teichouo\bsovmlpt.exe

C:\Windows\SysWOW64\teichouo\bsovmlpt.exe /d"C:\Users\Admin\AppData\Local\Temp\f27e816769871147e4862997714586f5_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3728 -ip 3728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 644

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2444 -ip 2444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 508

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.8.49:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.204.72:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 173.194.79.27:25 smtp.google.com tcp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
HK 43.231.4.7:443 tcp
US 8.8.8.8:53 66.229.138.52.in-addr.arpa udp

Files

memory/3728-1-0x0000000004380000-0x0000000004480000-memory.dmp

memory/3728-2-0x00000000041D0000-0x00000000041E3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bsovmlpt.exe

MD5 7b8119dcb72359cc3f10e908abdf5c8c
SHA1 c47a0b7d22d21d1b42288bd581f40c9e674b8330
SHA256 e07fbac69955586fd1e923bf50af719de00640048d6ad8ae7c4c6efe7b56ff22
SHA512 d8beff771b58fcb9c8e37ca89de7d5007abeba040143572b24c87c030acfe0285c0e14d92565708af765e07ce206b460ca8f21122e04a517f6133049c5bd28e5

memory/3728-6-0x0000000000400000-0x00000000040F8000-memory.dmp

memory/3728-7-0x00000000041D0000-0x00000000041E3000-memory.dmp

memory/2444-9-0x0000000004260000-0x0000000004360000-memory.dmp

memory/3860-10-0x0000000000810000-0x0000000000825000-memory.dmp

memory/3860-14-0x0000000000810000-0x0000000000825000-memory.dmp

memory/3860-15-0x0000000000810000-0x0000000000825000-memory.dmp

memory/2444-16-0x0000000000400000-0x00000000040F8000-memory.dmp

memory/3860-17-0x0000000000810000-0x0000000000825000-memory.dmp