Malware Analysis Report

2024-10-23 22:16

Sample ID 240508-crxs1sgb27
Target 22c773d478e58709306d15cc86c6097e_JaffaCakes118
SHA256 19dea1877949b3d0b99cf91fdd68e376fbc74d25fc914ce497f00ca0ecff77ce
Tags
formbook h9s persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

19dea1877949b3d0b99cf91fdd68e376fbc74d25fc914ce497f00ca0ecff77ce

Threat Level: Known bad

The file 22c773d478e58709306d15cc86c6097e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

formbook h9s persistence rat spyware stealer trojan

Formbook

Formbook payload

Adds policy Run key to start application

Deletes itself

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious behavior: MapViewOfSection

Suspicious use of UnmapMainImage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-08 02:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-08 02:19

Reported

2024-05-08 02:21

Platform

win7-20240221-en

Max time kernel

150s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Formbook

trojan spyware stealer formbook

Formbook payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\chkdsk.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Fabw\configkvkx8zr0.exe C:\Windows\SysWOW64\chkdsk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\chkdsk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\chkdsk.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2456 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2456 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2456 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2456 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2536 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2536 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2536 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2536 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2536 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2536 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2536 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 2536 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 1564 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\SysWOW64\chkdsk.exe
PID 1564 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\SysWOW64\chkdsk.exe
PID 1564 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\SysWOW64\chkdsk.exe
PID 1564 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\SysWOW64\chkdsk.exe
PID 2836 wrote to memory of 1324 N/A C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1324 N/A C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1324 N/A C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 1324 N/A C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Doc53436.exe

"C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"

C:\Users\Admin\AppData\Local\Temp\Doc53436.exe

"C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"

C:\Users\Admin\AppData\Local\Temp\Doc53436.exe

"C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"

C:\Windows\SysWOW64\chkdsk.exe

"C:\Windows\SysWOW64\chkdsk.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.artscurator.net udp
US 8.8.8.8:53 www.work-with-mfo.com udp
US 8.8.8.8:53 www.l3vdinnqj.online udp
US 8.8.8.8:53 www.mansim.com udp
US 13.248.169.48:80 www.mansim.com tcp

Files

memory/2456-3-0x00000000003B0000-0x00000000003B6000-memory.dmp

memory/2456-4-0x0000000077921000-0x0000000077A22000-memory.dmp

memory/2456-5-0x0000000077920000-0x0000000077AC9000-memory.dmp

C:\Windows\win.ini

MD5 d2a2412bddba16d60ec63bd9550d933f
SHA1 deb3d3bdc9055f0b4909b31d3048446848fae0e1
SHA256 79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a
SHA512 8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

memory/2536-12-0x00000000002A0000-0x00000000002A6000-memory.dmp

memory/2536-11-0x0000000077B10000-0x0000000077BE6000-memory.dmp

memory/1564-10-0x0000000000400000-0x000000000042A000-memory.dmp

memory/1564-13-0x0000000077920000-0x0000000077AC9000-memory.dmp

memory/1204-15-0x0000000002D80000-0x0000000002E80000-memory.dmp

memory/1204-16-0x0000000004BC0000-0x0000000004C9B000-memory.dmp

memory/1564-17-0x0000000000400000-0x000000000042A000-memory.dmp

memory/1564-18-0x0000000000400000-0x000000000042A000-memory.dmp

memory/1204-19-0x0000000006440000-0x0000000006505000-memory.dmp

memory/2836-23-0x0000000000770000-0x0000000000777000-memory.dmp

memory/2836-24-0x0000000000770000-0x0000000000777000-memory.dmp

memory/1204-25-0x0000000004BC0000-0x0000000004C9B000-memory.dmp

memory/1204-27-0x0000000006510000-0x00000000065D7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-08 02:19

Reported

2024-05-08 02:21

Platform

win10v2004-20240419-en

Max time kernel

148s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Formbook

trojan spyware stealer formbook

Formbook payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZRPD-6S0ZD = "C:\\Program Files (x86)\\Xu6al\\8pn0or6ql.exe" C:\Windows\SysWOW64\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3856 set thread context of 4212 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 4212 set thread context of 3476 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\Explorer.EXE
PID 4212 set thread context of 3476 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\Explorer.EXE
PID 3324 set thread context of 3476 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\Explorer.EXE

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Xu6al\8pn0or6ql.exe C:\Windows\SysWOW64\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \Registry\User\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3784 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3784 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3784 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3856 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3856 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3856 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3856 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3856 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3856 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 3856 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Users\Admin\AppData\Local\Temp\Doc53436.exe
PID 4212 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\SysWOW64\explorer.exe
PID 4212 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\SysWOW64\explorer.exe
PID 4212 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\Doc53436.exe C:\Windows\SysWOW64\explorer.exe
PID 3324 wrote to memory of 2708 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3324 wrote to memory of 2708 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3324 wrote to memory of 2708 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3324 wrote to memory of 1084 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3324 wrote to memory of 1084 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3324 wrote to memory of 1084 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Doc53436.exe

"C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"

C:\Users\Admin\AppData\Local\Temp\Doc53436.exe

"C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"

C:\Users\Admin\AppData\Local\Temp\Doc53436.exe

"C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Local\Temp\Doc53436.exe"

C:\Windows\SysWOW64\cmd.exe

/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 www.dynamicbrazil.win udp
US 8.8.8.8:53 www.backstorysongs.com udp
US 192.0.78.25:80 www.backstorysongs.com tcp
US 8.8.8.8:53 25.78.0.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 48.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 www.domidu.com udp
US 3.130.253.23:80 www.domidu.com tcp
US 8.8.8.8:53 23.253.130.3.in-addr.arpa udp
US 3.130.253.23:80 www.domidu.com tcp
US 3.130.253.23:80 www.domidu.com tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 www.bhadrakmarket.com udp
US 8.8.8.8:53 www.wsxyjx.com udp
HK 43.129.221.170:80 www.wsxyjx.com tcp
US 8.8.8.8:53 170.221.129.43.in-addr.arpa udp
HK 43.129.221.170:80 www.wsxyjx.com tcp
HK 43.129.221.170:80 www.wsxyjx.com tcp
US 8.8.8.8:53 www.palchecker.com udp

Files

memory/3784-2-0x0000000002140000-0x0000000002146000-memory.dmp

memory/3784-4-0x0000000076F81000-0x00000000770A1000-memory.dmp

C:\Windows\win.ini

MD5 6bf517432f65eb7f0d18d574bf14124c
SHA1 5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA256 6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
SHA512 7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

memory/3784-9-0x0000000002140000-0x0000000002146000-memory.dmp

memory/3856-10-0x0000000002110000-0x0000000002116000-memory.dmp

memory/4212-11-0x0000000000400000-0x000000000042A000-memory.dmp

memory/4212-13-0x0000000000400000-0x000000000042A000-memory.dmp

memory/3476-14-0x000000000AF00000-0x000000000B0A9000-memory.dmp

memory/3476-17-0x0000000007B00000-0x0000000007BE3000-memory.dmp

memory/4212-16-0x0000000000400000-0x000000000042A000-memory.dmp

memory/3324-21-0x0000000000AE0000-0x0000000000F13000-memory.dmp

memory/3324-23-0x0000000000AE0000-0x0000000000F13000-memory.dmp

memory/3476-24-0x000000000AF00000-0x000000000B0A9000-memory.dmp

memory/3476-26-0x0000000007B00000-0x0000000007BE3000-memory.dmp

memory/3476-27-0x0000000008C30000-0x0000000008DB7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DB1

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Roaming\47191082\471logrv.ini

MD5 bbc41c78bae6c71e63cb544a6a284d94
SHA1 33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256 ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA512 0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

C:\Users\Admin\AppData\Roaming\47191082\471logrg.ini

MD5 4aadf49fed30e4c9b3fe4a3dd6445ebe
SHA1 1e332822167c6f351b99615eada2c30a538ff037
SHA256 75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512 eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

C:\Users\Admin\AppData\Roaming\47191082\471logri.ini

MD5 d63a82e5d81e02e399090af26db0b9cb
SHA1 91d0014c8f54743bba141fd60c9d963f869d76c9
SHA256 eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA512 38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

C:\Users\Admin\AppData\Roaming\47191082\471logim.jpeg

MD5 dc21f5eb39b15d350362712222df9b01
SHA1 21435796ca7efa60c57b87619a63d2ecee8deb9c
SHA256 1647943a457b1c50ffd2ff12a1f1fecaa3f88ffea6181e9cbd4a6c62ca64de36
SHA512 07ebd3eaaf0f41d3dbc1191fc1ff1424961327760721a440ad59a4fbc663f3566000490752b135531e59727d2f65a3fbfe48ea28b8055d020cfab9b8aaf87b91