Overview

overview

10

Static

static

3

JaffaCakes...07.exe

windows7-x64

10

JaffaCakes...07.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 17:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_8c09682f34406064eed9412de458e907.exe

  • Size

    476KB

  • MD5

    8c09682f34406064eed9412de458e907

  • SHA1

    4af9e5e945891a2a86abc95f8c49935c0b7d1d10

  • SHA256

    5f272cc5a7816d99e32eadfec8fba293ab2ab9840806501b6f5ca2d041a82b13

  • SHA512

    253120907b2f598204502da641f5da06062a5d0086dddee7b88a7216f26367a28de0c254ec2f3204f53e94a5008b1b4473f36507fc2ab7de389c6af17a99a6de

  • SSDEEP

    6144:hj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionjf44:R6onxOp8FySpE5zvIdtU+Ymefr

Score
10/10
pykspadefense_evasiondiscoverypersistenceprivilege_escalationtrojanworm

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
    persistence
  • Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Pykspa family
    pykspa
  • UAC bypass 3 TTPs 20 IoCs
    defense_evasiontrojan
  • Detect Pykspa worm 2 IoCs
    worm
  • Adds policy Run key to start application 2 TTPs 48 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Executes dropped EXE 35 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
    defense_evasion
  • Loads dropped DLL 38 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 22 IoCs
    defense_evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 52 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c09682f34406064eed9412de458e907.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c09682f34406064eed9412de458e907.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
      "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_8c09682f34406064eed9412de458e907.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2116
      • C:\Users\Admin\AppData\Local\Temp\jpzhgm.exe
        "C:\Users\Admin\AppData\Local\Temp\jpzhgm.exe" "-C:\Users\Admin\AppData\Local\Temp\vlfxgwnazpjvwgwm.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:2860
      • C:\Users\Admin\AppData\Local\Temp\jpzhgm.exe
        "C:\Users\Admin\AppData\Local\Temp\jpzhgm.exe" "-C:\Users\Admin\AppData\Local\Temp\vlfxgwnazpjvwgwm.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2684
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\ctohriaoofanparil.exe
      "C:\Windows\ctohriaoofanparil.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\ctohriaoofanparil.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:952
    • C:\Users\Admin\AppData\Local\Temp\ytspdyumqlkbhwrmtrmli.exe
      "C:\Users\Admin\AppData\Local\Temp\ytspdyumqlkbhwrmtrmli.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:992
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\ytspdyumqlkbhwrmtrmli.exe*."
        3⤵
        • Executes dropped EXE
        PID:2636
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\vlfxgwnazpjvwgwm.exe
      "C:\Windows\vlfxgwnazpjvwgwm.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\vlfxgwnazpjvwgwm.exe*."
        3⤵
        • Executes dropped EXE
        PID:3032
    • C:\Users\Admin\AppData\Local\Temp\vlfxgwnazpjvwgwm.exe
      "C:\Users\Admin\AppData\Local\Temp\vlfxgwnazpjvwgwm.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\vlfxgwnazpjvwgwm.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2612
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Windows\wpmhtmgwyrodhunglha.exe
      "C:\Windows\wpmhtmgwyrodhunglha.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\wpmhtmgwyrodhunglha.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:3016
    • C:\Users\Admin\AppData\Local\Temp\ldztewpefxthkwogkf.exe
      "C:\Users\Admin\AppData\Local\Temp\ldztewpefxthkwogkf.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\ldztewpefxthkwogkf.exe*."
        3⤵
        • Executes dropped EXE
        PID:2288
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\ctohriaoofanparil.exe
      "C:\Windows\ctohriaoofanparil.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1952
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\ctohriaoofanparil.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:1716
    • C:\Users\Admin\AppData\Local\Temp\ldztewpefxthkwogkf.exe
      "C:\Users\Admin\AppData\Local\Temp\ldztewpefxthkwogkf.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1988
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\ldztewpefxthkwogkf.exe*."
        3⤵
        • Executes dropped EXE
        PID:3048
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2944
    • C:\Windows\ctohriaoofanparil.exe
      "C:\Windows\ctohriaoofanparil.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1064
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\ctohriaoofanparil.exe*."
        3⤵
        • Executes dropped EXE
        PID:2748
    • C:\Users\Admin\AppData\Local\Temp\vlfxgwnazpjvwgwm.exe
      "C:\Users\Admin\AppData\Local\Temp\vlfxgwnazpjvwgwm.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2800
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\vlfxgwnazpjvwgwm.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2344
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1464
    • C:\Windows\vlfxgwnazpjvwgwm.exe
      "C:\Windows\vlfxgwnazpjvwgwm.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3040
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\vlfxgwnazpjvwgwm.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:1904
    • C:\Users\Admin\AppData\Local\Temp\wpmhtmgwyrodhunglha.exe
      "C:\Users\Admin\AppData\Local\Temp\wpmhtmgwyrodhunglha.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2116
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\wpmhtmgwyrodhunglha.exe*."
        3⤵
        • Executes dropped EXE
        PID:1912
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1224
    • C:\Windows\ctohriaoofanparil.exe
      "C:\Windows\ctohriaoofanparil.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\ctohriaoofanparil.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:1988
    • C:\Users\Admin\AppData\Local\Temp\ctohriaoofanparil.exe
      "C:\Users\Admin\AppData\Local\Temp\ctohriaoofanparil.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3048
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\ctohriaoofanparil.exe*."
        3⤵
        • Executes dropped EXE
        PID:2144
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2892
    • C:\Windows\ytspdyumqlkbhwrmtrmli.exe
      "C:\Windows\ytspdyumqlkbhwrmtrmli.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1696
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\ytspdyumqlkbhwrmtrmli.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2592
    • C:\Users\Admin\AppData\Local\Temp\jdbxkezqtnlbguoiolfd.exe
      "C:\Users\Admin\AppData\Local\Temp\jdbxkezqtnlbguoiolfd.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2172
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\jdbxkezqtnlbguoiolfd.exe*."
        3⤵
        • Executes dropped EXE
        PID:2604

Network

  • flag-us
    DNS
    whatismyipaddress.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    whatismyipaddress.com
    IN A
    Response
    whatismyipaddress.com
    IN A
    104.19.223.79
    whatismyipaddress.com
    IN A
    104.19.222.79
  • flag-us
    GET
    http://whatismyipaddress.com/
    jpzhgm.exe
    Remote address:
    104.19.223.79:80
    Request
    GET / HTTP/1.1
    Host: whatismyipaddress.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 403 Forbidden
    Date: Sat, 29 Mar 2025 17:49:19 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 4525
    Connection: close
    Referrer-Policy: same-origin
    Cache-Control: max-age=15
    Expires: Sat, 29 Mar 2025 17:49:34 GMT
    X-Frame-Options: SAMEORIGIN
    Server: cloudflare
    CF-RAY: 928134063f057315-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    www.showmyipaddress.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    www.showmyipaddress.com
    IN A
    Response
    www.showmyipaddress.com
    IN A
    172.67.155.175
    www.showmyipaddress.com
    IN A
    104.21.74.56
  • flag-us
    GET
    http://www.showmyipaddress.com/
    jpzhgm.exe
    Remote address:
    172.67.155.175:80
    Request
    GET / HTTP/1.1
    Host: www.showmyipaddress.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sat, 29 Mar 2025 17:49:21 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: close
    Cache-Control: max-age=3600
    Expires: Sat, 29 Mar 2025 18:49:21 GMT
    Location: https://www.showmyipaddress.com/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bK673nM8Adq9p9zKw0aOVj3%2FFpP8i0Mz45D7Hz9qj%2F1DEnu5YATLWNU1CuN%2BLZUfEFK4ND2hIASjcHOa8PcYAnh7OM4eB2iOKOblKJtbOqc%2BTR4%2FZQgwaW3cgFr9%2F0pRJqs5mC75aivupA%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9281340f080e7778-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=46335&min_rtt=46335&rtt_var=23167&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=183&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://whatismyipaddress.com/
    jpzhgm.exe
    Remote address:
    104.19.223.79:80
    Request
    GET / HTTP/1.1
    Host: whatismyipaddress.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 403 Forbidden
    Date: Sat, 29 Mar 2025 17:49:22 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 4525
    Connection: close
    Referrer-Policy: same-origin
    Cache-Control: max-age=15
    Expires: Sat, 29 Mar 2025 17:49:37 GMT
    X-Frame-Options: SAMEORIGIN
    Server: cloudflare
    CF-RAY: 928134160d1e60e7-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    www.whatismyip.ca
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    www.whatismyip.ca
    IN A
    Response
  • flag-us
    DNS
    whatismyip.everdot.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    whatismyip.everdot.org
    IN A
    Response
  • flag-us
    GET
    http://whatismyipaddress.com/
    jpzhgm.exe
    Remote address:
    104.19.223.79:80
    Request
    GET / HTTP/1.1
    Host: whatismyipaddress.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 403 Forbidden
    Date: Sat, 29 Mar 2025 17:49:25 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 4525
    Connection: close
    Referrer-Policy: same-origin
    Cache-Control: max-age=15
    Expires: Sat, 29 Mar 2025 17:49:40 GMT
    X-Frame-Options: SAMEORIGIN
    Server: cloudflare
    CF-RAY: 9281342a6c58fcfd-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    www.whatismyip.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    www.whatismyip.com
    IN A
    Response
    www.whatismyip.com
    IN A
    172.66.40.87
    www.whatismyip.com
    IN A
    172.66.43.169
  • flag-us
    GET
    http://www.whatismyip.com/
    jpzhgm.exe
    Remote address:
    172.66.40.87:80
    Request
    GET / HTTP/1.1
    Host: www.whatismyip.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sat, 29 Mar 2025 17:49:27 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: close
    Cache-Control: max-age=3600
    Expires: Sat, 29 Mar 2025 18:49:27 GMT
    Location: https://www.whatismyip.com/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qZkXkAEBnUV11lTiefzMpTLyJPVOkH66B03YqnjnJM8A%2FbwvfKPMl8Fsmg%2BfOmCRHD6UiqHUtIw%2BRrpUNujVOokhhqrv6ui%2FPkqy8JPsvFNJNaIl3OfYdhxnLYOPcsqe1d3dyw%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 92813437ff2e4e60-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=43452&min_rtt=43452&rtt_var=21726&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=178&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://www.showmyipaddress.com/
    jpzhgm.exe
    Remote address:
    172.67.155.175:80
    Request
    GET / HTTP/1.1
    Host: www.showmyipaddress.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sat, 29 Mar 2025 17:49:29 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: close
    Cache-Control: max-age=3600
    Expires: Sat, 29 Mar 2025 18:49:29 GMT
    Location: https://www.showmyipaddress.com/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tzypMLxphaa%2FWLoONBys1vAm1uRjVyqX%2FFAPdBypBLYHklQ%2B4IBnuYNVqHP1sRyTKJM7gh5ED%2FPZmw7uedUQf53L%2FRLk%2FcFvNxw2w8e2e8mTdkY3%2B7KNN25GVaSCBtuD7YT%2FUHS2DrJ7qw%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 928134455fb8ef2f-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=43074&min_rtt=43074&rtt_var=21537&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=183&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://www.showmyipaddress.com/
    jpzhgm.exe
    Remote address:
    172.67.155.175:80
    Request
    GET / HTTP/1.1
    Host: www.showmyipaddress.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sat, 29 Mar 2025 17:49:32 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: close
    Cache-Control: max-age=3600
    Expires: Sat, 29 Mar 2025 18:49:32 GMT
    Location: https://www.showmyipaddress.com/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eAIWwV0Kh%2F0qZYgGSTMfSptEb7Coh95dl%2B8jHVmRQbC8fDNQFsveZFlytUOD%2FxdPxcbaWaI1lHht5mKXFegieLStES8zQKdqOny7AfJ6gZ5Ok8nUGtGZJRwYxoHocqq5zBBLIOvSRfyR7g%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 928134590ef963ab-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=51676&min_rtt=51676&rtt_var=25838&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=183&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://www.whatismyip.com/
    jpzhgm.exe
    Remote address:
    172.66.40.87:80
    Request
    GET / HTTP/1.1
    Host: www.whatismyip.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sat, 29 Mar 2025 17:49:37 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: close
    Cache-Control: max-age=3600
    Expires: Sat, 29 Mar 2025 18:49:37 GMT
    Location: https://www.whatismyip.com/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F5jAjtg9mM%2FRiCavLK%2BRrjvCwuh1fD%2FLfn0ZZ4TPw7QFPWDXwUik%2Frpirng5Y4wiyM7JLL%2B2dQbVWdK%2BxdCzNrdzYxPGEZzjZtJIUor%2BSY%2BU%2BJ8myyJ2duWAeKHxv03yFfraxw%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 92813472ccb59505-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=42999&min_rtt=42999&rtt_var=21499&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=178&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://www.whatismyip.com/
    jpzhgm.exe
    Remote address:
    172.66.40.87:80
    Request
    GET / HTTP/1.1
    Host: www.whatismyip.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sat, 29 Mar 2025 17:49:40 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: close
    Cache-Control: max-age=3600
    Expires: Sat, 29 Mar 2025 18:49:40 GMT
    Location: https://www.whatismyip.com/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kqztFekpqmOdLnpa0tL41V4xttDtpJaFnHzgnEQ4o1i0nxbcKkiXCZ2LartKbeZTLEu%2FhIibiulOoEob4cx0IPILFVkviU5PibLeXboJvMSx44qL%2F%2BIck%2BusVFUvUDBSu27Mrg%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 928134869a63e5af-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=58708&min_rtt=58708&rtt_var=29354&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=178&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://www.whatismyip.com/
    jpzhgm.exe
    Remote address:
    172.66.40.87:80
    Request
    GET / HTTP/1.1
    Host: www.whatismyip.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sat, 29 Mar 2025 17:49:41 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: close
    Cache-Control: max-age=3600
    Expires: Sat, 29 Mar 2025 18:49:41 GMT
    Location: https://www.whatismyip.com/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HsAFv40T2%2Bqx0sxxbfkg9PLclkBCLA3Uzuh5uWeQhEIC9e3n8%2B3Bp5cA5Vm97BezFAnEcqgAY5FWxQlwN%2FAabFzdI9DM%2ByCNm16gxCoceHSramP8dlFvzqfbhgb9fK7F1VHFHg%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 9281348d9f20cd42-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=54529&min_rtt=54529&rtt_var=27264&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=178&delivery_rate=0&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://whatismyipaddress.com/
    jpzhgm.exe
    Remote address:
    104.19.223.79:80
    Request
    GET / HTTP/1.1
    Host: whatismyipaddress.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 403 Forbidden
    Date: Sat, 29 Mar 2025 17:49:43 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 4525
    Connection: close
    Referrer-Policy: same-origin
    Cache-Control: max-age=15
    Expires: Sat, 29 Mar 2025 17:49:58 GMT
    X-Frame-Options: SAMEORIGIN
    Server: cloudflare
    CF-RAY: 9281349af85b3784-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    http://whatismyipaddress.com/
    jpzhgm.exe
    Remote address:
    104.19.223.79:80
    Request
    GET / HTTP/1.1
    Host: whatismyipaddress.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 403 Forbidden
    Date: Sat, 29 Mar 2025 17:49:44 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 4525
    Connection: close
    Referrer-Policy: same-origin
    Cache-Control: max-age=15
    Expires: Sat, 29 Mar 2025 17:49:59 GMT
    X-Frame-Options: SAMEORIGIN
    Server: cloudflare
    CF-RAY: 928134a1eadd9584-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    www.youtube.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    www.youtube.com
    IN A
    Response
    www.youtube.com
    IN CNAME
    youtube-ui.l.google.com
    youtube-ui.l.google.com
    IN A
    216.58.201.110
    youtube-ui.l.google.com
    IN A
    142.250.179.238
    youtube-ui.l.google.com
    IN A
    172.217.169.14
    youtube-ui.l.google.com
    IN A
    216.58.213.14
    youtube-ui.l.google.com
    IN A
    142.250.200.46
    youtube-ui.l.google.com
    IN A
    172.217.169.78
    youtube-ui.l.google.com
    IN A
    172.217.169.46
    youtube-ui.l.google.com
    IN A
    216.58.212.238
    youtube-ui.l.google.com
    IN A
    142.250.200.14
    youtube-ui.l.google.com
    IN A
    216.58.204.78
    youtube-ui.l.google.com
    IN A
    172.217.16.238
    youtube-ui.l.google.com
    IN A
    142.250.180.14
    youtube-ui.l.google.com
    IN A
    142.250.187.238
    youtube-ui.l.google.com
    IN A
    142.250.187.206
    youtube-ui.l.google.com
    IN A
    142.250.178.14
  • flag-us
    DNS
    www.youtube.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    www.youtube.com
    IN A
  • flag-gb
    GET
    http://www.youtube.com/
    jpzhgm.exe
    Remote address:
    216.58.201.110:80
    Request
    GET / HTTP/1.1
    Host: www.youtube.com
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Content-Type: application/binary
    X-Content-Type-Options: nosniff
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Sat, 29 Mar 2025 17:49:46 GMT
    Location: https://www.youtube.com/
    Server: ESF
    Content-Length: 0
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Connection: close
  • flag-us
    DNS
    jnroptvip.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    jnroptvip.org
    IN A
    Response
    jnroptvip.org
    IN A
    178.162.217.107
    jnroptvip.org
    IN A
    5.79.71.205
    jnroptvip.org
    IN A
    178.162.203.202
    jnroptvip.org
    IN A
    85.17.31.82
    jnroptvip.org
    IN A
    178.162.203.211
    jnroptvip.org
    IN A
    178.162.203.226
    jnroptvip.org
    IN A
    85.17.31.122
    jnroptvip.org
    IN A
    5.79.71.225
  • flag-us
    DNS
    banqzqj.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    banqzqj.com
    IN A
    Response
  • flag-us
    DNS
    ibahngptv.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    ibahngptv.net
    IN A
    Response
  • flag-us
    DNS
    bthqhh.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    bthqhh.net
    IN A
    Response
  • flag-us
    DNS
    kcwuooaeec.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    kcwuooaeec.org
    IN A
    Response
  • flag-us
    DNS
    hmdsckbwnfn.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    hmdsckbwnfn.org
    IN A
    Response
  • flag-us
    DNS
    aafibwgqhfb.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    aafibwgqhfb.info
    IN A
    Response
    aafibwgqhfb.info
    IN A
    85.214.228.140
  • flag-de
    GET
    http://aafibwgqhfb.info/
    jpzhgm.exe
    Remote address:
    85.214.228.140:80
    Request
    GET / HTTP/1.1
    Host: aafibwgqhfb.info
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/plain; charset=utf-8
    X-Content-Type-Options: nosniff
    Date: Sat, 29 Mar 2025 17:49:58 GMT
    Content-Length: 19
    Connection: close
  • flag-us
    DNS
    wobunqdaxsy.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    wobunqdaxsy.net
    IN A
    Response
  • flag-us
    DNS
    wobunqdaxsy.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    wobunqdaxsy.net
    IN A
  • flag-us
    DNS
    whtstuzsayr.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    whtstuzsayr.net
    IN A
    Response
  • flag-us
    DNS
    wklujonitiv.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    wklujonitiv.info
    IN A
    Response
  • flag-us
    DNS
    khjiudxjbl.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    khjiudxjbl.info
    IN A
    Response
  • flag-us
    DNS
    mmiegqks.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    mmiegqks.org
    IN A
    Response
    mmiegqks.org
    IN A
    13.213.51.196
  • flag-us
    DNS
    uwbykav.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    uwbykav.info
    IN A
    Response
  • flag-us
    DNS
    dujgovvyrkj.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    dujgovvyrkj.com
    IN A
    Response
  • flag-us
    DNS
    dujgovvyrkj.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    dujgovvyrkj.com
    IN A
  • flag-us
    DNS
    wucohin.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    wucohin.info
    IN A
    Response
  • flag-us
    DNS
    wgoaio.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    wgoaio.com
    IN A
    Response
  • flag-us
    DNS
    zflhvnncos.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    zflhvnncos.info
    IN A
    Response
  • flag-us
    DNS
    qrhslmdmhanr.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    qrhslmdmhanr.net
    IN A
    Response
  • flag-us
    DNS
    gdsmlzbwimxu.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    gdsmlzbwimxu.info
    IN A
    Response
  • flag-us
    DNS
    lwujjelylqeb.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    lwujjelylqeb.net
    IN A
    Response
  • flag-us
    DNS
    srcutxzgmdtp.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    srcutxzgmdtp.net
    IN A
    Response
  • flag-us
    DNS
    fxhiznjuqy.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    fxhiznjuqy.info
    IN A
    Response
  • flag-us
    DNS
    eswmekaomioi.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    eswmekaomioi.org
    IN A
    Response
  • flag-us
    DNS
    ayocaacowkku.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    ayocaacowkku.org
    IN A
    Response
  • flag-us
    DNS
    tmjmesq.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    tmjmesq.org
    IN A
    Response
  • flag-us
    DNS
    witkuoe.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    witkuoe.net
    IN A
    Response
  • flag-us
    DNS
    wexczejvh.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    wexczejvh.info
    IN A
    Response
  • flag-us
    DNS
    wexczejvh.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    wexczejvh.info
    IN A
    Response
  • flag-us
    DNS
    yoxwjwdfckxx.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    yoxwjwdfckxx.net
    IN A
    Response
  • flag-us
    DNS
    ymhwgajqn.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    ymhwgajqn.net
    IN A
    Response
  • flag-us
    DNS
    skbxrnyqhok.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    skbxrnyqhok.info
    IN A
    Response
  • flag-us
    DNS
    yvryrqqzi.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    yvryrqqzi.info
    IN A
    Response
    yvryrqqzi.info
    IN A
    104.156.155.94
  • flag-us
    GET
    http://yvryrqqzi.info/
    jpzhgm.exe
    Remote address:
    104.156.155.94:80
    Request
    GET / HTTP/1.1
    Host: yvryrqqzi.info
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.18.0 (Ubuntu)
    Date: Sat, 29 Mar 2025 17:50:54 GMT
    Content-Type: text/html
    Content-Length: 162
    Connection: close
  • flag-us
    DNS
    xfmklx.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    xfmklx.info
    IN A
    Response
  • flag-us
    DNS
    tfxrndvswnfb.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    tfxrndvswnfb.info
    IN A
    Response
  • flag-us
    DNS
    mmwewuccic.com
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    mmwewuccic.com
    IN A
    Response
  • flag-us
    DNS
    uogyis.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    uogyis.org
    IN A
    Response
  • flag-us
    DNS
    cgnjzyp.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    cgnjzyp.net
    IN A
    Response
  • flag-us
    DNS
    nhofhlbxz.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    nhofhlbxz.net
    IN A
    Response
  • flag-us
    DNS
    sehjjxefdt.net
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    sehjjxefdt.net
    IN A
    Response
  • flag-us
    DNS
    pkpzvfsrcbco.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    pkpzvfsrcbco.info
    IN A
    Response
  • flag-us
    DNS
    zrzevhziz.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    zrzevhziz.org
    IN A
    Response
  • flag-us
    DNS
    zrzevhziz.org
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    zrzevhziz.org
    IN A
  • flag-us
    DNS
    qozpdmtcuq.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    qozpdmtcuq.info
    IN A
    Response
  • flag-us
    DNS
    qozpdmtcuq.info
    jpzhgm.exe
    Remote address:
    8.8.8.8:53
    Request
    qozpdmtcuq.info
    IN A
    Response
  • 104.19.223.79:80
    http://whatismyipaddress.com/
    http
    jpzhgm.exe
    549 B
     5.2kB
     8
    8

    HTTP Request

    GET http://whatismyipaddress.com/

    HTTP Response

    403
  • 172.67.155.175:80
    http://www.showmyipaddress.com/
    http
    jpzhgm.exe
    413 B
     1.2kB
     5
    4

    HTTP Request

    GET http://www.showmyipaddress.com/

    HTTP Response

    301
  • 104.19.223.79:80
    http://whatismyipaddress.com/
    http
    jpzhgm.exe
    503 B
     5.1kB
     7
    6

    HTTP Request

    GET http://whatismyipaddress.com/

    HTTP Response

    403
  • 104.19.223.79:80
    http://whatismyipaddress.com/
    http
    jpzhgm.exe
    549 B
     5.2kB
     8
    7

    HTTP Request

    GET http://whatismyipaddress.com/

    HTTP Response

    403
  • 172.66.40.87:80
    http://www.whatismyip.com/
    http
    jpzhgm.exe
    408 B
     1.2kB
     5
    4

    HTTP Request

    GET http://www.whatismyip.com/

    HTTP Response

    301
  • 172.67.155.175:80
    http://www.showmyipaddress.com/
    http
    jpzhgm.exe
    413 B
     1.2kB
     5
    4

    HTTP Request

    GET http://www.showmyipaddress.com/

    HTTP Response

    301
  • 172.67.155.175:80
    http://www.showmyipaddress.com/
    http
    jpzhgm.exe
    413 B
     1.2kB
     5
    4

    HTTP Request

    GET http://www.showmyipaddress.com/

    HTTP Response

    301
  • 172.66.40.87:80
    http://www.whatismyip.com/
    http
    jpzhgm.exe
    460 B
     1.2kB
     6
    4

    HTTP Request

    GET http://www.whatismyip.com/

    HTTP Response

    301
  • 172.66.40.87:80
    http://www.whatismyip.com/
    http
    jpzhgm.exe
    408 B
     1.2kB
     5
    4

    HTTP Request

    GET http://www.whatismyip.com/

    HTTP Response

    301
  • 172.66.40.87:80
    http://www.whatismyip.com/
    http
    jpzhgm.exe
    408 B
     1.2kB
     5
    4

    HTTP Request

    GET http://www.whatismyip.com/

    HTTP Response

    301
  • 104.19.223.79:80
    http://whatismyipaddress.com/
    http
    jpzhgm.exe
    503 B
     5.2kB
     7
    7

    HTTP Request

    GET http://whatismyipaddress.com/

    HTTP Response

    403
  • 104.19.223.79:80
    http://whatismyipaddress.com/
    http
    jpzhgm.exe
    503 B
     5.2kB
     7
    7

    HTTP Request

    GET http://whatismyipaddress.com/

    HTTP Response

    403
  • 216.58.201.110:80
    http://www.youtube.com/
    http
    jpzhgm.exe
    405 B
     608 B
     5
    5

    HTTP Request

    GET http://www.youtube.com/

    HTTP Response

    301
  • 178.88.6.201:31303
    jpzhgm.exe
    104 B
     2
  • 78.61.163.119:41302
    jpzhgm.exe
    104 B
     2
  • 85.214.228.140:80
    http://aafibwgqhfb.info/
    http
    jpzhgm.exe
    452 B
     407 B
     6
    5

    HTTP Request

    GET http://aafibwgqhfb.info/

    HTTP Response

    404
  • 89.116.58.73:33895
    jpzhgm.exe
    104 B
     2
  • 78.62.142.40:40100
    jpzhgm.exe
    104 B
     2
  • 13.213.51.196:80
    mmiegqks.org
    jpzhgm.exe
    152 B
     3
  • 78.56.136.59:34876
    jpzhgm.exe
    104 B
     2
  • 85.108.251.189:45401
    jpzhgm.exe
    104 B
     2
  • 77.78.40.224:29794
    jpzhgm.exe
    104 B
     2
  • 178.90.117.254:32692
    jpzhgm.exe
    104 B
     2
  • 85.15.88.62:27116
    jpzhgm.exe
    104 B
     2
  • 85.130.98.94:17447
    jpzhgm.exe
    104 B
     2
  • 85.232.129.77:42551
    jpzhgm.exe
    104 B
     2
  • 93.123.100.205:38603
    jpzhgm.exe
    104 B
     2
  • 104.156.155.94:80
    http://yvryrqqzi.info/
    http
    jpzhgm.exe
    404 B
     493 B
     5
    4

    HTTP Request

    GET http://yvryrqqzi.info/

    HTTP Response

    404
  • 88.223.5.42:35390
    jpzhgm.exe
    104 B
     2
  • 86.100.130.193:42982
    jpzhgm.exe
    104 B
     2
  • 94.244.89.151:43519
    jpzhgm.exe
    52 B
     1
  • 8.8.8.8:53
    whatismyipaddress.com
    dns
    jpzhgm.exe
    67 B
     99 B
     1
    1

    DNS Request

    whatismyipaddress.com

    DNS Response

    104.19.223.79
    104.19.222.79

  • 8.8.8.8:53
    www.showmyipaddress.com
    dns
    jpzhgm.exe
    69 B
     101 B
     1
    1

    DNS Request

    www.showmyipaddress.com

    DNS Response

    172.67.155.175
    104.21.74.56

  • 8.8.8.8:53
    www.whatismyip.ca
    dns
    jpzhgm.exe
    63 B
     130 B
     1
    1

    DNS Request

    www.whatismyip.ca

  • 8.8.8.8:53
    whatismyip.everdot.org
    dns
    jpzhgm.exe
    68 B
     116 B
     1
    1

    DNS Request

    whatismyip.everdot.org

  • 8.8.8.8:53
    www.whatismyip.com
    dns
    jpzhgm.exe
    64 B
     96 B
     1
    1

    DNS Request

    www.whatismyip.com

    DNS Response

    172.66.40.87
    172.66.43.169

  • 8.8.8.8:53
    www.youtube.com
    dns
    jpzhgm.exe
    122 B
     335 B
     2
    1

    DNS Request

    www.youtube.com

    DNS Request

    www.youtube.com

    DNS Response

    216.58.201.110
    142.250.179.238
    172.217.169.14
    216.58.213.14
    142.250.200.46
    172.217.169.78
    172.217.169.46
    216.58.212.238
    142.250.200.14
    216.58.204.78
    172.217.16.238
    142.250.180.14
    142.250.187.238
    142.250.187.206
    142.250.178.14

  • 8.8.8.8:53
    jnroptvip.org
    dns
    jpzhgm.exe
    59 B
     187 B
     1
    1

    DNS Request

    jnroptvip.org

    DNS Response

    178.162.217.107
    5.79.71.205
    178.162.203.202
    85.17.31.82
    178.162.203.211
    178.162.203.226
    85.17.31.122
    5.79.71.225

  • 8.8.8.8:53
    banqzqj.com
    dns
    jpzhgm.exe
    57 B
     130 B
     1
    1

    DNS Request

    banqzqj.com

  • 8.8.8.8:53
    ibahngptv.net
    dns
    jpzhgm.exe
    59 B
     132 B
     1
    1

    DNS Request

    ibahngptv.net

  • 8.8.8.8:53
    bthqhh.net
    dns
    jpzhgm.exe
    56 B
     129 B
     1
    1

    DNS Request

    bthqhh.net

  • 8.8.8.8:53
    kcwuooaeec.org
    dns
    jpzhgm.exe
    60 B
     142 B
     1
    1

    DNS Request

    kcwuooaeec.org

  • 8.8.8.8:53
    hmdsckbwnfn.org
    dns
    jpzhgm.exe
    61 B
     143 B
     1
    1

    DNS Request

    hmdsckbwnfn.org

  • 8.8.8.8:53
    aafibwgqhfb.info
    dns
    jpzhgm.exe
    62 B
     78 B
     1
    1

    DNS Request

    aafibwgqhfb.info

    DNS Response

    85.214.228.140

  • 8.8.8.8:53
    wobunqdaxsy.net
    dns
    jpzhgm.exe
    122 B
     134 B
     2
    1

    DNS Request

    wobunqdaxsy.net

    DNS Request

    wobunqdaxsy.net

  • 8.8.8.8:53
    whtstuzsayr.net
    dns
    jpzhgm.exe
    61 B
     134 B
     1
    1

    DNS Request

    whtstuzsayr.net

  • 8.8.8.8:53
    wklujonitiv.info
    dns
    jpzhgm.exe
    62 B
     141 B
     1
    1

    DNS Request

    wklujonitiv.info

  • 8.8.8.8:53
    khjiudxjbl.info
    dns
    jpzhgm.exe
    61 B
     140 B
     1
    1

    DNS Request

    khjiudxjbl.info

  • 8.8.8.8:53
    mmiegqks.org
    dns
    jpzhgm.exe
    58 B
     74 B
     1
    1

    DNS Request

    mmiegqks.org

    DNS Response

    13.213.51.196

  • 8.8.8.8:53
    uwbykav.info
    dns
    jpzhgm.exe
    58 B
     137 B
     1
    1

    DNS Request

    uwbykav.info

  • 8.8.8.8:53
    dujgovvyrkj.com
    dns
    jpzhgm.exe
    122 B
     134 B
     2
    1

    DNS Request

    dujgovvyrkj.com

    DNS Request

    dujgovvyrkj.com

  • 8.8.8.8:53
    wucohin.info
    dns
    jpzhgm.exe
    58 B
     137 B
     1
    1

    DNS Request

    wucohin.info

  • 8.8.8.8:53
    wgoaio.com
    dns
    jpzhgm.exe
    56 B
     129 B
     1
    1

    DNS Request

    wgoaio.com

  • 8.8.8.8:53
    zflhvnncos.info
    dns
    jpzhgm.exe
    61 B
     140 B
     1
    1

    DNS Request

    zflhvnncos.info

  • 8.8.8.8:53
    qrhslmdmhanr.net
    dns
    jpzhgm.exe
    62 B
     135 B
     1
    1

    DNS Request

    qrhslmdmhanr.net

  • 8.8.8.8:53
    gdsmlzbwimxu.info
    dns
    jpzhgm.exe
    63 B
     142 B
     1
    1

    DNS Request

    gdsmlzbwimxu.info

  • 8.8.8.8:53
    lwujjelylqeb.net
    dns
    jpzhgm.exe
    62 B
     135 B
     1
    1

    DNS Request

    lwujjelylqeb.net

  • 8.8.8.8:53
    srcutxzgmdtp.net
    dns
    jpzhgm.exe
    62 B
     135 B
     1
    1

    DNS Request

    srcutxzgmdtp.net

  • 8.8.8.8:53
    fxhiznjuqy.info
    dns
    jpzhgm.exe
    61 B
     140 B
     1
    1

    DNS Request

    fxhiznjuqy.info

  • 8.8.8.8:53
    eswmekaomioi.org
    dns
    jpzhgm.exe
    62 B
     144 B
     1
    1

    DNS Request

    eswmekaomioi.org

  • 8.8.8.8:53
    ayocaacowkku.org
    dns
    jpzhgm.exe
    62 B
     144 B
     1
    1

    DNS Request

    ayocaacowkku.org

  • 8.8.8.8:53
    tmjmesq.org
    dns
    jpzhgm.exe
    57 B
     139 B
     1
    1

    DNS Request

    tmjmesq.org

  • 8.8.8.8:53
    witkuoe.net
    dns
    jpzhgm.exe
    57 B
     130 B
     1
    1

    DNS Request

    witkuoe.net

  • 8.8.8.8:53
    wexczejvh.info
    dns
    jpzhgm.exe
    120 B
     278 B
     2
    2

    DNS Request

    wexczejvh.info

    DNS Request

    wexczejvh.info

  • 8.8.8.8:53
    yoxwjwdfckxx.net
    dns
    jpzhgm.exe
    62 B
     135 B
     1
    1

    DNS Request

    yoxwjwdfckxx.net

  • 8.8.8.8:53
    ymhwgajqn.net
    dns
    jpzhgm.exe
    59 B
     132 B
     1
    1

    DNS Request

    ymhwgajqn.net

  • 8.8.8.8:53
    skbxrnyqhok.info
    dns
    jpzhgm.exe
    62 B
     141 B
     1
    1

    DNS Request

    skbxrnyqhok.info

  • 8.8.8.8:53
    yvryrqqzi.info
    dns
    jpzhgm.exe
    60 B
     76 B
     1
    1

    DNS Request

    yvryrqqzi.info

    DNS Response

    104.156.155.94

  • 8.8.8.8:53
    xfmklx.info
    dns
    jpzhgm.exe
    57 B
     136 B
     1
    1

    DNS Request

    xfmklx.info

  • 8.8.8.8:53
    tfxrndvswnfb.info
    dns
    jpzhgm.exe
    63 B
     142 B
     1
    1

    DNS Request

    tfxrndvswnfb.info

  • 8.8.8.8:53
    mmwewuccic.com
    dns
    jpzhgm.exe
    60 B
     133 B
     1
    1

    DNS Request

    mmwewuccic.com

  • 8.8.8.8:53
    uogyis.org
    dns
    jpzhgm.exe
    56 B
     138 B
     1
    1

    DNS Request

    uogyis.org

  • 8.8.8.8:53
    cgnjzyp.net
    dns
    jpzhgm.exe
    57 B
     130 B
     1
    1

    DNS Request

    cgnjzyp.net

  • 8.8.8.8:53
    nhofhlbxz.net
    dns
    jpzhgm.exe
    59 B
     132 B
     1
    1

    DNS Request

    nhofhlbxz.net

  • 8.8.8.8:53
    sehjjxefdt.net
    dns
    jpzhgm.exe
    60 B
     133 B
     1
    1

    DNS Request

    sehjjxefdt.net

  • 8.8.8.8:53
    pkpzvfsrcbco.info
    dns
    jpzhgm.exe
    63 B
     142 B
     1
    1

    DNS Request

    pkpzvfsrcbco.info

  • 8.8.8.8:53
    zrzevhziz.org
    dns
    jpzhgm.exe
    118 B
     141 B
     2
    1

    DNS Request

    zrzevhziz.org

    DNS Request

    zrzevhziz.org

  • 8.8.8.8:53
    qozpdmtcuq.info
    dns
    jpzhgm.exe
    122 B
     280 B
     2
    2

    DNS Request

    qozpdmtcuq.info

    DNS Request

    qozpdmtcuq.info

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Safe Mode Boot

1
T1562.009

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\azcdvuuqyxavfyxwhjilm.ddz
    Filesize

    272B

    MD5

    0138b96d046da08b914391bb14f1d0cd

    SHA1

    49e869f86c563ff98acc57c148fe73d4c6c47997

    SHA256

    300a6595ffdd5266cb87238b71db09f520f1c4c57e1e55f06a2bd65f23507864

    SHA512

    5a583518cd8aa05bc7090072419a9c73e398b1bd531542a567e581053006c1af63b4e3028168c80894a2b0818ed9a64c6711a655bbc726c7950897ca0200bb5c

    Download Submit

  • C:\Program Files (x86)\azcdvuuqyxavfyxwhjilm.ddz
    Filesize

    272B

    MD5

    0eccc2d9bc2e7405df89d5df7cd4110e

    SHA1

    879a5862341d026d800f3275025ae8c164d7bf15

    SHA256

    3b4375aec18bbfc39a29a093272d953700f21c8d89b7d142e297f43f502a3f9b

    SHA512

    9afd957d83ede033378162e3158329ac7e57a1266ddf49fe993e195d6fb01a64b8136e14f1a1f0766e63440bf732a10d6bea9774bb8df0c07c34c4d626c73830

    Download Submit

  • C:\Program Files (x86)\azcdvuuqyxavfyxwhjilm.ddz
    Filesize

    272B

    MD5

    939d460c91df36c2ab7e97aaaff8fe1d

    SHA1

    8572c721a446ce7955129d327cba8d6d4f0d7aa5

    SHA256

    7f426daaad24caf571f168d1e00d4c1d7c211c0786a25fa8d1f0090f869c2e35

    SHA512

    1ad9e62393d399af65dc21d55dc66dccf84724194297f7346e1941e5d66c044673f55b319602be551e3d1b19f10a9654e37073ba8a6632e7a1aadc81a8f6dc7e

    Download Submit

  • C:\Program Files (x86)\azcdvuuqyxavfyxwhjilm.ddz
    Filesize

    272B

    MD5

    932775b3ef436280d126f25f4447fe90

    SHA1

    293ef7b5da2186b3759bc9077ae6dddab95ba3f1

    SHA256

    fc1069b030479f96dd1a2e87607c4f7de522bc541526b29aefd257674678f797

    SHA512

    5d2ffb529371b6dc27c3d7661c5bec9df44318deffecf0c33ac07a0180660b162875a62f441e03e8f7cf0ad7a5c57b63cb4f8e67ce7ef3f84a96e91b8d320144

    Download Submit

  • C:\Program Files (x86)\azcdvuuqyxavfyxwhjilm.ddz
    Filesize

    272B

    MD5

    e6a013c14872b5a5df580cf915c57426

    SHA1

    2040dc443eddcf74e49535d838d954d2a92e94ad

    SHA256

    0ff0623f2e0b8ac78a5fc95927387ed5dd323091f40aabeec1e8000456ec421e

    SHA512

    b8f21f2630fd41c84b73a609e3f58d6c89cc3ef7c193001a80d847125fc292810d18f1f49cba9c39d1d22bd890df77d94c983dcded61b3837cbd612c0b04dbdc

    Download Submit

  • C:\Users\Admin\AppData\Local\azcdvuuqyxavfyxwhjilm.ddz
    Filesize

    272B

    MD5

    7ade648c8f12af9d615e978359211260

    SHA1

    21bc6d407858a02ea977c7e774b8bf7fdf16a25f

    SHA256

    d305d57fce4fa745a35ab70cefb023e617e2fbae1d6f856f38e51eb306577df4

    SHA512

    0de7af26ef1f0721223edc1508e1d7d1da327819441ea8edd085ca6af7d3fe4600730ff3b142c9cf51889bdaf92ff630617eefe8f0440d0f66fd7d794edacd1d

    Download Submit

  • C:\Users\Admin\AppData\Local\vftfisdkdnbhcgqawjthtwgryrbpvque.kxh
    Filesize

    3KB

    MD5

    163c9b70de7b001f99d86cd2fc09a130

    SHA1

    cd5134adeb239b357496e24ad5fef4352218507b

    SHA256

    a9be0ea3817ebac255f6d8fee28d63d5aea5db1b146e678ab75804aab1968cb5

    SHA512

    48c7eda23c0905df2950590b9eb884664f57b19f7bcd3aba6878d06a0605f177909ebf2a343332368225cc4f9be7849bb9e3fa4c92ce6ec77357981957a1bceb

    Download Submit

  • C:\Windows\SysWOW64\ldztewpefxthkwogkf.exe
    Filesize

    476KB

    MD5

    8c09682f34406064eed9412de458e907

    SHA1

    4af9e5e945891a2a86abc95f8c49935c0b7d1d10

    SHA256

    5f272cc5a7816d99e32eadfec8fba293ab2ab9840806501b6f5ca2d041a82b13

    SHA512

    253120907b2f598204502da641f5da06062a5d0086dddee7b88a7216f26367a28de0c254ec2f3204f53e94a5008b1b4473f36507fc2ab7de389c6af17a99a6de

    Download Submit

  • \Users\Admin\AppData\Local\Temp\jpzhgm.exe
    Filesize

    704KB

    MD5

    f7e9ccbec66ff76e19820e4c0f2669d8

    SHA1

    27b2a3f425d5c11772776ed32447e034c0f7e2b8

    SHA256

    c05ab951a2b604518c99938fa6453ff5e990ef5e14e0be786ac90629b28de03a

    SHA512

    58620e0613401515c0c6148048d5dd4a126ee01eedf7216d3c220dfe2c45d8ca7a4478ef9be805d6d5c9c77c80d9c2b3e8773e3ec72ad7d55401f9aced78b607

    Download Submit

  • \Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
    Filesize

    320KB

    MD5

    5203b6ea0901877fbf2d8d6f6d8d338e

    SHA1

    c803e92561921b38abe13239c1fd85605b570936

    SHA256

    0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060

    SHA512

    d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471

    Download Submit

  • memory/1224-401-0x0000000004530000-0x0000000004531000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1464-387-0x0000000004480000-0x0000000004481000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2292-339-0x00000000044E0000-0x00000000044E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2328-186-0x0000000004590000-0x0000000004591000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2944-355-0x0000000004A00000-0x0000000004A01000-memory.dmp

    Filesize

    4KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.