Malware Analysis Report

2025-01-18 12:23

Sample ID 221116-lg25esdh7z
Target PO N°CF0043032.js
SHA256 7ec7e2dc90c17f8aef0148566b49e811f43957191be844d8ed55520eb99f7281
Tags
vjw0rm wshrat persistence trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7ec7e2dc90c17f8aef0148566b49e811f43957191be844d8ed55520eb99f7281

Threat Level: Known bad

The file PO N°CF0043032.js was found to be: Known bad.

Malicious Activity Summary

vjw0rm wshrat persistence trojan worm

Vjw0rm

WSHRAT

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Script User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-16 09:31

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-16 09:31

Reported

2022-11-16 09:33

Platform

win7-20221111-en

Max time kernel

146s

Max time network

151s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO N°CF0043032.js"

Signatures

Vjw0rm

trojan worm vjw0rm

WSHRAT

trojan wshrat

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHzEwHpjUM.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF0043032.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF0043032.js C:\Windows\system32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHzEwHpjUM.js C:\Windows\System32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF0043032 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO N°CF0043032.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO N°CF0043032 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO N°CF0043032.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 16/11/2022|JavaScript N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 952 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2024 wrote to memory of 952 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2024 wrote to memory of 952 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO N°CF0043032.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PHzEwHpjUM.js"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 javaautorun.duia.ro udp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp

Files

memory/2024-54-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

memory/952-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\PHzEwHpjUM.js

MD5 ba291ea77a5ff539a8fb6bc0f7969704
SHA1 4e4f274ca59c75e6b5f8eed51b7bb720e061c14d
SHA256 ae249598ed6c8c1882e24418c8979f49cae0a18e35cdbe152a2dfd1874ec6cdf
SHA512 ac3a4cf9caf11f0c53161770607da4943a74377e02f1e49699af9055f3c9badc59f1103bd5a1b931b0f43a474e2ead6a44c00798518b9ab48eae0f5d8f949402

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-16 09:31

Reported

2022-11-16 09:33

Platform

win10v2004-20220812-en

Max time kernel

150s

Max time network

151s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO N°CF0043032.js"

Signatures

Vjw0rm

trojan worm vjw0rm

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHzEwHpjUM.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHzEwHpjUM.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF0043032.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF0043032.js C:\Windows\system32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF0043032 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO N°CF0043032.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF0043032 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO N°CF0043032.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 16/11/2022|JavaScript N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3044 wrote to memory of 2508 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 3044 wrote to memory of 2508 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO N°CF0043032.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PHzEwHpjUM.js"

Network

Country Destination Domain Proto
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 8.8.8.8:53 javaautorun.duia.ro udp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 93.184.220.29:80 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.101.78.82:80 tcp
N/A 95.101.78.82:80 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 104.80.225.205:443 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 51.11.192.48:443 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp
N/A 95.142.119.17:5465 javaautorun.duia.ro tcp
N/A 84.38.130.210:2070 84.38.130.210 tcp

Files

memory/2508-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\PHzEwHpjUM.js

MD5 ba291ea77a5ff539a8fb6bc0f7969704
SHA1 4e4f274ca59c75e6b5f8eed51b7bb720e061c14d
SHA256 ae249598ed6c8c1882e24418c8979f49cae0a18e35cdbe152a2dfd1874ec6cdf
SHA512 ac3a4cf9caf11f0c53161770607da4943a74377e02f1e49699af9055f3c9badc59f1103bd5a1b931b0f43a474e2ead6a44c00798518b9ab48eae0f5d8f949402