Malware Analysis Report

2025-06-15 21:06

Sample ID 220817-v3z2madfd2
Target TRANSFERENCIA $112987.17.js
SHA256 5dfaea003a9b484fad723fc13f79303169e4c8f2f414a4ee0ef187f7ebd0aac9
Tags
vjw0rm trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5dfaea003a9b484fad723fc13f79303169e4c8f2f414a4ee0ef187f7ebd0aac9

Threat Level: Known bad

The file TRANSFERENCIA $112987.17.js was found to be: Known bad.

Malicious Activity Summary

vjw0rm trojan worm

Vjw0rm

Blocklisted process makes network request

Drops startup file

Checks computer location settings

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-08-17 17:31

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-08-17 17:31

Reported

2022-08-17 17:36

Platform

win7-20220812-en

Max time kernel

299s

Max time network

304s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA $112987.17.js"

Signatures

Vjw0rm

trojan worm vjw0rm

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jQCWVHjWAA.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jQCWVHjWAA.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js C:\Windows\System32\wscript.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1248 wrote to memory of 1976 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1248 wrote to memory of 1976 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1248 wrote to memory of 1976 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1976 wrote to memory of 1624 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 1976 wrote to memory of 1624 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 1976 wrote to memory of 1624 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA $112987.17.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jQCWVHjWAA.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js"

Network

Country Destination Domain Proto
US 8.8.8.8:53 kodencherycollege.ac.in udp
SG 148.66.137.120:443 kodencherycollege.ac.in tcp
US 8.8.8.8:53 macjoe597.duia.ro udp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
SG 148.66.137.120:443 kodencherycollege.ac.in tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
SG 148.66.137.120:443 kodencherycollege.ac.in tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp

Files

memory/1976-54-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\jQCWVHjWAA.js

MD5 1f7855c87513cf8d9f4b5319445865cf
SHA1 a73d48e0da18067c2e943da97c45acb679e18139
SHA256 b386904566434edecd5319ebe730f8c5ecd05d8003eaf8b695cc771aa17c2579
SHA512 41eb3f05e08fa6b878b1a8ffa90cba44756be53ea09d00c63425ba176f1bef31dc677caea99acfb2e6298403efaae1af4e71ea5a7fe29158a9c0510bfee022a9

memory/1624-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js

MD5 a542a21ecaba36f6ba8c6457b8ab67f9
SHA1 3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c
SHA256 bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b
SHA512 78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a

memory/1624-58-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-08-17 17:31

Reported

2022-08-17 17:36

Platform

win10v2004-20220812-en

Max time kernel

294s

Max time network

300s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA $112987.17.js"

Signatures

Vjw0rm

trojan worm vjw0rm

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jQCWVHjWAA.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jQCWVHjWAA.js C:\Windows\System32\wscript.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 4944 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2172 wrote to memory of 4944 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 4944 wrote to memory of 4844 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 4944 wrote to memory of 4844 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA $112987.17.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jQCWVHjWAA.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js"

Network

Country Destination Domain Proto
NL 95.101.78.82:80 tcp
US 8.8.8.8:53 kodencherycollege.ac.in udp
SG 148.66.137.120:443 kodencherycollege.ac.in tcp
US 8.8.8.8:53 macjoe597.duia.ro udp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
US 20.189.173.13:443 tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
US 8.8.8.8:53 226.101.242.52.in-addr.arpa udp
NL 104.80.225.205:443 tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
NL 95.101.78.82:80 tcp
NL 95.101.78.82:80 tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
US 209.197.3.8:80 tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp

Files

memory/4944-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\jQCWVHjWAA.js

MD5 1f7855c87513cf8d9f4b5319445865cf
SHA1 a73d48e0da18067c2e943da97c45acb679e18139
SHA256 b386904566434edecd5319ebe730f8c5ecd05d8003eaf8b695cc771aa17c2579
SHA512 41eb3f05e08fa6b878b1a8ffa90cba44756be53ea09d00c63425ba176f1bef31dc677caea99acfb2e6298403efaae1af4e71ea5a7fe29158a9c0510bfee022a9

memory/4844-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js

MD5 a542a21ecaba36f6ba8c6457b8ab67f9
SHA1 3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c
SHA256 bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b
SHA512 78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a