Malware Analysis Report

2025-05-28 15:55

Sample ID 220926-lejkasace6
Target Order_PO62525112155.js
SHA256 b5fe0b324c6401f3b25e3dc121d159b663cfd2e58dfe161fddfdef7e107f4f80
Tags
formbook vjw0rm douy rat spyware stealer trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b5fe0b324c6401f3b25e3dc121d159b663cfd2e58dfe161fddfdef7e107f4f80

Threat Level: Known bad

The file Order_PO62525112155.js was found to be: Known bad.

Malicious Activity Summary

formbook vjw0rm douy rat spyware stealer trojan worm

Vjw0rm

Formbook

Executes dropped EXE

Blocklisted process makes network request

Reads user/profile data of web browsers

Drops startup file

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-09-26 09:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-09-26 09:26

Reported

2022-09-26 09:29

Platform

win7-20220812-en

Max time kernel

150s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

Formbook

trojan spyware stealer formbook

Vjw0rm

trojan worm vjw0rm

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\binx.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spFEowQViP.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spFEowQViP.js C:\Windows\System32\wscript.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1280 set thread context of 1432 N/A C:\Users\Admin\AppData\Local\Temp\binx.exe C:\Windows\Explorer.EXE
PID 1592 set thread context of 1432 N/A C:\Windows\SysWOW64\msiexec.exe C:\Windows\Explorer.EXE

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 240 wrote to memory of 1908 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 240 wrote to memory of 1908 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 240 wrote to memory of 1908 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 240 wrote to memory of 1280 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\binx.exe
PID 240 wrote to memory of 1280 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\binx.exe
PID 240 wrote to memory of 1280 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\binx.exe
PID 240 wrote to memory of 1280 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\binx.exe
PID 1432 wrote to memory of 1592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\msiexec.exe
PID 1432 wrote to memory of 1592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\msiexec.exe
PID 1432 wrote to memory of 1592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\msiexec.exe
PID 1432 wrote to memory of 1592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\msiexec.exe
PID 1432 wrote to memory of 1592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\msiexec.exe
PID 1432 wrote to memory of 1592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\msiexec.exe
PID 1432 wrote to memory of 1592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\msiexec.exe
PID 1592 wrote to memory of 1648 N/A C:\Windows\SysWOW64\msiexec.exe C:\Program Files\Mozilla Firefox\Firefox.exe
PID 1592 wrote to memory of 1648 N/A C:\Windows\SysWOW64\msiexec.exe C:\Program Files\Mozilla Firefox\Firefox.exe
PID 1592 wrote to memory of 1648 N/A C:\Windows\SysWOW64\msiexec.exe C:\Program Files\Mozilla Firefox\Firefox.exe
PID 1592 wrote to memory of 1648 N/A C:\Windows\SysWOW64\msiexec.exe C:\Program Files\Mozilla Firefox\Firefox.exe
PID 1592 wrote to memory of 1648 N/A C:\Windows\SysWOW64\msiexec.exe C:\Program Files\Mozilla Firefox\Firefox.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Order_PO62525112155.js

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\spFEowQViP.js"

C:\Users\Admin\AppData\Local\Temp\binx.exe

"C:\Users\Admin\AppData\Local\Temp\binx.exe"

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\msiexec.exe"

C:\Program Files\Mozilla Firefox\Firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 javaautorun.duia.ro udp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
US 8.8.8.8:53 www.sagemill.org udp
IN 116.206.105.137:80 www.sagemill.org tcp
US 8.8.8.8:53 www.sqlite.org udp
US 45.33.6.223:80 www.sqlite.org tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
US 8.8.8.8:53 www.kotan1992.com udp
JP 163.44.79.97:80 www.kotan1992.com tcp
JP 163.44.79.97:80 www.kotan1992.com tcp
US 8.8.8.8:53 www.btc-lab.xyz udp
DE 64.190.63.111:80 www.btc-lab.xyz tcp
DE 64.190.63.111:80 www.btc-lab.xyz tcp
US 8.8.8.8:53 www.klodifiks.space udp
US 8.8.8.8:53 www.lifebook2000.com udp
SG 139.180.152.51:80 www.lifebook2000.com tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
SG 139.180.152.51:80 www.lifebook2000.com tcp
US 8.8.8.8:53 www.codirus.com udp
GB 185.215.4.66:80 www.codirus.com tcp
GB 185.215.4.66:80 www.codirus.com tcp
US 8.8.8.8:53 www.livetv24hd.xyz udp
DE 5.9.120.245:80 www.livetv24hd.xyz tcp
DE 5.9.120.245:80 www.livetv24hd.xyz tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
US 8.8.8.8:53 www.lovingblues.com udp
DE 185.53.177.54:80 www.lovingblues.com tcp
DE 185.53.177.54:80 www.lovingblues.com tcp
US 8.8.8.8:53 www.pbjwhiskey.org udp
US 208.91.197.27:80 www.pbjwhiskey.org tcp
US 208.91.197.27:80 www.pbjwhiskey.org tcp
US 8.8.8.8:53 www.suttazet.com udp
US 162.0.228.17:80 www.suttazet.com tcp
US 162.0.228.17:80 www.suttazet.com tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
US 8.8.8.8:53 www.sportask.org udp
RU 89.253.230.46:80 www.sportask.org tcp
RU 89.253.230.46:80 www.sportask.org tcp
US 8.8.8.8:53 www.bigeasypizza.com udp
US 35.186.238.101:80 www.bigeasypizza.com tcp
US 35.186.238.101:80 www.bigeasypizza.com tcp
US 8.8.8.8:53 www.teenoi168.org udp
DE 91.195.240.94:80 www.teenoi168.org tcp

Files

memory/240-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

memory/1908-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\spFEowQViP.js

MD5 4326214270abe9617a275433b8c6e10b
SHA1 f7f175d352a1b08c702101ef47d46cf5f79e1bf3
SHA256 b06c913e4c3d3e5476ff270359cfd431ae6cedb6088e7ce6dd78eb01f5e2603f
SHA512 b576ada7cfb97f367f1e3480a9fb02b630584ac7f5826c6a21f75046961cb724e6733a53b96cd24843bc06edbb25fbc5585e1164f1cf34ec5533a1c8e0490ac8

memory/1280-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\binx.exe

MD5 21718633ba6c7c6e83147a334dd6266c
SHA1 5459c562ed6c407ce38b860ce4e594e9c3744235
SHA256 43917a72ddc8088875ae0d248876d31f6dffd5ad4bb18a25ae5cadf2a7010bf6
SHA512 8c37c1eda02435ad02a411a57efc035cdd69cb43a0b5da6f21b470ac56e9ea2eba041587b8c41bd6539a0905603990d2939104dafc029af6fe35bbd6a22d836a

memory/1280-60-0x0000000000A40000-0x0000000000A6F000-memory.dmp

memory/1280-61-0x0000000000A70000-0x0000000000D73000-memory.dmp

memory/1280-62-0x0000000000110000-0x0000000000120000-memory.dmp

memory/1432-63-0x0000000006920000-0x0000000006AC6000-memory.dmp

memory/1592-64-0x0000000000000000-mapping.dmp

memory/1592-65-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\binx.exe

MD5 21718633ba6c7c6e83147a334dd6266c
SHA1 5459c562ed6c407ce38b860ce4e594e9c3744235
SHA256 43917a72ddc8088875ae0d248876d31f6dffd5ad4bb18a25ae5cadf2a7010bf6
SHA512 8c37c1eda02435ad02a411a57efc035cdd69cb43a0b5da6f21b470ac56e9ea2eba041587b8c41bd6539a0905603990d2939104dafc029af6fe35bbd6a22d836a

memory/1592-67-0x0000000000540000-0x0000000000554000-memory.dmp

memory/1592-68-0x00000000000E0000-0x000000000010D000-memory.dmp

memory/1592-69-0x0000000002170000-0x0000000002473000-memory.dmp

memory/1592-70-0x0000000000420000-0x00000000004AF000-memory.dmp

memory/1432-71-0x0000000007050000-0x0000000007155000-memory.dmp

memory/1592-72-0x00000000000E0000-0x000000000010D000-memory.dmp

\Users\Admin\AppData\Local\Temp\sqlite3.dll

MD5 f1e5f58f9eb43ecec773acbdb410b888
SHA1 f1b8076b0bbde696694bbc0ab259a77893839464
SHA256 a15fd84ee61b54c92bb099dfb78226548f43d550c67fb6adf4cce3d064ab1c14
SHA512 0aff96430dd99bb227285fefc258014c301f85216c84e40f45702d26cdd7e77261a41fd3811d686f5fb2ee363cc651a014e8ffa339384004cece645a36486456

memory/1432-74-0x0000000007050000-0x0000000007155000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-09-26 09:26

Reported

2022-09-26 09:29

Platform

win10v2004-20220812-en

Max time kernel

150s

Max time network

152s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Order_PO62525112155.js

Signatures

Formbook

trojan spyware stealer formbook

Vjw0rm

trojan worm vjw0rm

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\binx.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spFEowQViP.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spFEowQViP.js C:\Windows\System32\wscript.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1600 set thread context of 2712 N/A C:\Users\Admin\AppData\Local\Temp\binx.exe C:\Windows\Explorer.EXE
PID 1600 set thread context of 2712 N/A C:\Users\Admin\AppData\Local\Temp\binx.exe C:\Windows\Explorer.EXE
PID 3932 set thread context of 2712 N/A C:\Windows\SysWOW64\cscript.exe C:\Windows\Explorer.EXE

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Windows\SysWOW64\cscript.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\binx.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\cscript.exe N/A

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Order_PO62525112155.js

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\spFEowQViP.js"

C:\Users\Admin\AppData\Local\Temp\binx.exe

"C:\Users\Admin\AppData\Local\Temp\binx.exe"

C:\Windows\SysWOW64\cscript.exe

"C:\Windows\SysWOW64\cscript.exe"

C:\Program Files\Mozilla Firefox\Firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 javaautorun.duia.ro udp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
US 93.184.220.29:80 tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
US 8.8.8.8:53 www.sagemill.org udp
IN 116.206.105.137:80 www.sagemill.org tcp
NL 104.80.225.205:443 tcp
US 20.42.73.26:443 tcp
US 8.8.8.8:53 www.kotan1992.com udp
JP 163.44.79.97:80 www.kotan1992.com tcp
JP 163.44.79.97:80 www.kotan1992.com tcp
JP 163.44.79.97:80 www.kotan1992.com tcp
JP 163.44.79.97:80 www.kotan1992.com tcp
US 8.8.8.8:53 www.btc-lab.xyz udp
DE 64.190.63.111:80 www.btc-lab.xyz tcp
DE 64.190.63.111:80 www.btc-lab.xyz tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
DE 64.190.63.111:80 www.btc-lab.xyz tcp
DE 64.190.63.111:80 www.btc-lab.xyz tcp
US 8.8.8.8:53 www.klodifiks.space udp
US 8.8.8.8:53 www.lifebook2000.com udp
SG 139.180.152.51:80 www.lifebook2000.com tcp
SG 139.180.152.51:80 www.lifebook2000.com tcp
SG 139.180.152.51:80 www.lifebook2000.com tcp
SG 139.180.152.51:80 www.lifebook2000.com tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
US 8.8.8.8:53 www.codirus.com udp
GB 185.215.4.66:80 www.codirus.com tcp
GB 185.215.4.66:80 www.codirus.com tcp
GB 185.215.4.66:80 www.codirus.com tcp
GB 185.215.4.66:80 www.codirus.com tcp
US 8.8.8.8:53 www.livetv24hd.xyz udp
DE 5.9.120.245:80 www.livetv24hd.xyz tcp
DE 5.9.120.245:80 www.livetv24hd.xyz tcp
DE 5.9.120.245:80 www.livetv24hd.xyz tcp
DE 5.9.120.245:80 www.livetv24hd.xyz tcp
US 8.8.8.8:53 www.lovingblues.com udp
DE 185.53.177.54:80 www.lovingblues.com tcp
DE 185.53.177.54:80 www.lovingblues.com tcp
DE 185.53.177.54:80 www.lovingblues.com tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
DE 185.53.177.54:80 www.lovingblues.com tcp
US 8.8.8.8:53 www.pbjwhiskey.org udp
US 208.91.197.27:80 www.pbjwhiskey.org tcp
US 208.91.197.27:80 www.pbjwhiskey.org tcp
US 208.91.197.27:80 www.pbjwhiskey.org tcp
US 208.91.197.27:80 www.pbjwhiskey.org tcp
US 8.8.8.8:53 www.suttazet.com udp
US 162.0.228.17:80 www.suttazet.com tcp
US 162.0.228.17:80 www.suttazet.com tcp
US 162.0.228.17:80 www.suttazet.com tcp
US 162.0.228.17:80 www.suttazet.com tcp
NG 41.217.38.90:5433 javaautorun.duia.ro tcp
US 8.8.8.8:53 www.sportask.org udp
RU 89.253.230.46:80 www.sportask.org tcp
RU 89.253.230.46:80 www.sportask.org tcp
RU 89.253.230.46:80 www.sportask.org tcp

Files

memory/4676-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\spFEowQViP.js

MD5 4326214270abe9617a275433b8c6e10b
SHA1 f7f175d352a1b08c702101ef47d46cf5f79e1bf3
SHA256 b06c913e4c3d3e5476ff270359cfd431ae6cedb6088e7ce6dd78eb01f5e2603f
SHA512 b576ada7cfb97f367f1e3480a9fb02b630584ac7f5826c6a21f75046961cb724e6733a53b96cd24843bc06edbb25fbc5585e1164f1cf34ec5533a1c8e0490ac8

C:\Users\Admin\AppData\Local\Temp\binx.exe

MD5 21718633ba6c7c6e83147a334dd6266c
SHA1 5459c562ed6c407ce38b860ce4e594e9c3744235
SHA256 43917a72ddc8088875ae0d248876d31f6dffd5ad4bb18a25ae5cadf2a7010bf6
SHA512 8c37c1eda02435ad02a411a57efc035cdd69cb43a0b5da6f21b470ac56e9ea2eba041587b8c41bd6539a0905603990d2939104dafc029af6fe35bbd6a22d836a

memory/1600-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\binx.exe

MD5 21718633ba6c7c6e83147a334dd6266c
SHA1 5459c562ed6c407ce38b860ce4e594e9c3744235
SHA256 43917a72ddc8088875ae0d248876d31f6dffd5ad4bb18a25ae5cadf2a7010bf6
SHA512 8c37c1eda02435ad02a411a57efc035cdd69cb43a0b5da6f21b470ac56e9ea2eba041587b8c41bd6539a0905603990d2939104dafc029af6fe35bbd6a22d836a

memory/1600-137-0x00000000005A0000-0x00000000005CF000-memory.dmp

memory/1600-138-0x00000000011F0000-0x000000000153A000-memory.dmp

memory/1600-139-0x00000000007F0000-0x0000000000800000-memory.dmp

memory/2712-140-0x0000000002C60000-0x0000000002D3F000-memory.dmp

memory/1600-141-0x0000000001170000-0x0000000001180000-memory.dmp

memory/2712-142-0x0000000002D40000-0x0000000002EA7000-memory.dmp

memory/1600-143-0x00000000005A0000-0x00000000005CF000-memory.dmp

memory/3932-144-0x0000000000000000-mapping.dmp

memory/3932-146-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3932-145-0x0000000000D10000-0x0000000000D37000-memory.dmp

memory/3932-147-0x00000000026C0000-0x0000000002A0A000-memory.dmp

memory/3932-148-0x0000000002350000-0x00000000023DF000-memory.dmp

memory/2712-149-0x0000000003180000-0x000000000323A000-memory.dmp

memory/3932-150-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2712-151-0x0000000003180000-0x000000000323A000-memory.dmp