Malware Analysis Report

2024-10-23 16:28

Sample ID 240416-k9564sga5w
Target f32bc79d3ad21de604fa37038da7e745_JaffaCakes118
SHA256 3f487cd4fe611496acdd0cb193385e2bb233d535e99b5f6caadcf172150f38a5
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3f487cd4fe611496acdd0cb193385e2bb233d535e99b5f6caadcf172150f38a5

Threat Level: Known bad

The file f32bc79d3ad21de604fa37038da7e745_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Windows security bypass

Creates new service(s)

Modifies Windows Firewall

Sets service image path in registry

Deletes itself

Executes dropped EXE

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-16 09:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-16 09:19

Reported

2024-04-16 09:21

Platform

win7-20240221-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\sjegljgf = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\sjegljgf\ImagePath = "C:\\Windows\\SysWOW64\\sjegljgf\\jzzzofld.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 944 set thread context of 2536 N/A C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2228 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2228 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2228 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2228 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2228 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2228 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2228 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2228 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2228 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2228 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2228 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2228 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 944 wrote to memory of 2536 N/A C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe C:\Windows\SysWOW64\svchost.exe
PID 944 wrote to memory of 2536 N/A C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe C:\Windows\SysWOW64\svchost.exe
PID 944 wrote to memory of 2536 N/A C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe C:\Windows\SysWOW64\svchost.exe
PID 944 wrote to memory of 2536 N/A C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe C:\Windows\SysWOW64\svchost.exe
PID 944 wrote to memory of 2536 N/A C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe C:\Windows\SysWOW64\svchost.exe
PID 944 wrote to memory of 2536 N/A C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sjegljgf\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jzzzofld.exe" C:\Windows\SysWOW64\sjegljgf\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create sjegljgf binPath= "C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe /d\"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description sjegljgf "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start sjegljgf

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe

C:\Windows\SysWOW64\sjegljgf\jzzzofld.exe /d"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 98.136.96.91:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 173.194.79.26:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/2228-1-0x0000000000930000-0x0000000000A30000-memory.dmp

memory/2228-2-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2228-4-0x0000000000400000-0x0000000000870000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jzzzofld.exe

MD5 a94724ad7e598ac564dab496363d1ed8
SHA1 8359432828016342bfa9743fdae44830800306cc
SHA256 ac7b4fe779cef69ca5e64e263d50842c5aed2f48ab61947e5a2dcaa3c4172838
SHA512 3929b2a3802faf8415c4f6906e4798bfa9e00efe7e641959e3aacf3581feb238a002ca4312340e9390b54d1fa7a66049b35000a9fc3015eb733582b12c1f275a

memory/2228-7-0x0000000000400000-0x0000000000870000-memory.dmp

memory/944-10-0x0000000000A40000-0x0000000000B40000-memory.dmp

memory/2536-9-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2536-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/944-11-0x0000000000400000-0x0000000000870000-memory.dmp

memory/2536-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/944-15-0x0000000000400000-0x0000000000870000-memory.dmp

memory/2536-18-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2536-19-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2536-20-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-16 09:19

Reported

2024-04-16 09:21

Platform

win10v2004-20240412-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\adubduys\ImagePath = "C:\\Windows\\SysWOW64\\adubduys\\xecnsnbp.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\adubduys\xecnsnbp.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3280 set thread context of 2968 N/A C:\Windows\SysWOW64\adubduys\xecnsnbp.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4192 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4192 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4192 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4192 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4192 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4192 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4192 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 4192 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 4192 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 4192 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3280 wrote to memory of 2968 N/A C:\Windows\SysWOW64\adubduys\xecnsnbp.exe C:\Windows\SysWOW64\svchost.exe
PID 3280 wrote to memory of 2968 N/A C:\Windows\SysWOW64\adubduys\xecnsnbp.exe C:\Windows\SysWOW64\svchost.exe
PID 3280 wrote to memory of 2968 N/A C:\Windows\SysWOW64\adubduys\xecnsnbp.exe C:\Windows\SysWOW64\svchost.exe
PID 3280 wrote to memory of 2968 N/A C:\Windows\SysWOW64\adubduys\xecnsnbp.exe C:\Windows\SysWOW64\svchost.exe
PID 3280 wrote to memory of 2968 N/A C:\Windows\SysWOW64\adubduys\xecnsnbp.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\adubduys\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xecnsnbp.exe" C:\Windows\SysWOW64\adubduys\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create adubduys binPath= "C:\Windows\SysWOW64\adubduys\xecnsnbp.exe /d\"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description adubduys "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start adubduys

C:\Windows\SysWOW64\adubduys\xecnsnbp.exe

C:\Windows\SysWOW64\adubduys\xecnsnbp.exe /d"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4192 -ip 4192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1036

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3280 -ip 3280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 512

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 132.250.30.184.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.8.49:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 98.136.96.76:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 23.53.113.159:80 tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 173.194.79.26:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp

Files

memory/4192-1-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

memory/4192-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

memory/4192-4-0x0000000000400000-0x0000000000870000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xecnsnbp.exe

MD5 90a87ddb210cd64e39d00a809ec608cf
SHA1 a5a187728b068371679c9c628addbb31023908b2
SHA256 1332cafe6cf2a9d24a96ce35e959a17b151c9fd264170cc238c7c50dcada7c0e
SHA512 0090e2e10403c6b3aae619acc3c5a2fd356d7e35aec48e4fda9a368706dc8b4ddf48c1e705f47e0fe1a40cd3976c6207a493e5de8f797f61fa9886c0983a69ad

memory/4192-8-0x0000000000400000-0x0000000000870000-memory.dmp

memory/4192-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

memory/3280-10-0x0000000000B90000-0x0000000000C90000-memory.dmp

memory/3280-12-0x0000000000400000-0x0000000000870000-memory.dmp

memory/2968-11-0x0000000000640000-0x0000000000655000-memory.dmp

memory/2968-16-0x0000000000640000-0x0000000000655000-memory.dmp

memory/2968-17-0x0000000000640000-0x0000000000655000-memory.dmp

memory/3280-18-0x0000000000400000-0x0000000000870000-memory.dmp

memory/2968-19-0x0000000000640000-0x0000000000655000-memory.dmp