Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d56d03cf867c851d4e4c2d1aeb84567c.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
d56d03cf867c851d4e4c2d1aeb84567c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
d56d03cf867c851d4e4c2d1aeb84567c.exe
-
Size
57KB
-
MD5
d56d03cf867c851d4e4c2d1aeb84567c
-
SHA1
a20e94bbbdd5c0f14a7ca5578785367df8090a74
-
SHA256
55ec79e53cdc15127c847539dcbc14d157826e52aaea97ff8e76bd805eec1287
-
SHA512
50cbe56bc89a98690cde762c8d7c830be14c5f4aa86360e650f572f40c7dcada5422b16eafd8a009d96300c9795e01dd247430dbef13628a2d9519d366567134
-
SSDEEP
768:tUNFMNsyQLwtceTbdVUF3Ozt/eI6quKGLC4tPtt0tq3I63sC7Q4ciyxF/8oFIyu8:9QEtceTbd+FehGIGDc/xF/EFcsMpC
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cp barn = "C:\\Windows\\system32\\b0g.exe" d56d03cf867c851d4e4c2d1aeb84567c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cp barn = "C:\\Windows\\system32\\b0g.exe" d56d03cf867c851d4e4c2d1aeb84567c.exe -
Enumerates connected drives 3 TTPs 19 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\R: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\V: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\I: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\M: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\T: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\L: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\P: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\W: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\J: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\Q: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\H: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\K: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\N: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\S: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\U: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\X: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\E: d56d03cf867c851d4e4c2d1aeb84567c.exe File opened (read-only) \??\G: d56d03cf867c851d4e4c2d1aeb84567c.exe -
Drops file in System32 directory 35 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\ime\shared\res\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Windows\SysWOW64\b0g.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\res\Kazaa Lite.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\res\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\res\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\res\Norton AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\Kazaa Lite.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\Paris Hilton Screensaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\Spyware Removal.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\syswow64\ime\shared\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\res\Spyware Removal.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\SpyBot Search And Destroy.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification C:\Windows\SysWOW64\b0g.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\res\Paris Hilton Screensaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\Visual Studio.NET.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\Paris Hilton Screensaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\Visual Studio.NET.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\res\Visual Studio.NET.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\res\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\SpyBot Search And Destroy.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\Visual Studio.NET.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File opened for modification \??\c:\windows\syswow64\ime\shared\res\Norton AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\SysWOW64\ime\shared\Paris Hilton Screensaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\Norton AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\travel\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\msinfo\it-it\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\triedit\ja-jp\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\filters\E-Mule [Latest Version].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\tlãJwc:\program files\common files\microsoft shared\triedit\es-es\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\breeze\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\compass\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\translat\frar\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\shatter\c:\program files\dvd maker\shared\dvdstyles\travel\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\euro\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\smart tag\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\textconv\ja-jp\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\arctic\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\boldstri\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\triedit\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\flippage\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\bluecalm\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\concrete\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\help\1042\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\help\1028\WinZip.exec:\program files (xu v\YaìYaìtìc:\program files (x86)\common files\microsoft shared\help\3082\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\ink\fr-fr\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\vsta\8.0\x86\Norton AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\rmnsque\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\filters\SpyBot Search And Destroy.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ink\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ilãJwc:\program files\common files\microsoft shared\msinfo\es-es\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\translat\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\triedit\it-it\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\windows sidebar\shared gadgets\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\triedit\es-es\Brianna Banks and Jenna Jameson ScreenSaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\grphflt\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\indust\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shlãJwÂ6xpíc:\program files (x86)\common files\microsoft shared\msinfo\de-de\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\aftrnoon\WinZip.exec:\program u v\YaìYaìtìc:\program files (x86)\common files\microsoft shared\themes14\concrete\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\rmnsque\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\vba\vba6\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\vba\vba7\1033\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\vignette\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\textconv\de-de\WinZip.exec:\program files (x86)\common files\microsoft shared\textconv\en-us\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\vsta\pipeline.v10.0\hostsideadapters\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Paris Hilton Screensaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\textconv\Cable Uncapper.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\deepblue\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ink\sr-latn-cs\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\textconv\fr-fr\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\oldage\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\shatter\c:\program files\dvd maker\shared\dvdstyles\stacking\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shlãJwÂ6xpíc:\program files (x86)\common filu v\YaìYaìtìc:\program files (x86)\common files\microsoft shared\msinfo\en-us\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\expeditn\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\vsta\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\concrete\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\aftrnoon\WinZip.exec:\program u v\YaìYaìtìc:\program files (x86)\common files\microsoft shared\themes14\satin\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\filters\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\babyboy\Kazaa Lite.exec:\program files\dvd maker\shared\dvdstyles\babygirl\Kazaa Lite.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\smart tag\lists\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\Paris Hilton Screensaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Kazaa Lite.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\Norton AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\SpyBot Search And Destroy.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-detectionandsharingapi_31bf3856ad364e35_6.1.7600.16385_none_95980881f7dcdc33\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\14.0.0.0__71e9bce111e9429c\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Norton AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\Kazaa Lite.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-detectionandsharingapi_31bf3856ad364e35_6.1.7600.16385_none_95980881f7dcdc33\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\e2e42e6b0f65a618da8ab7235c27faf0\Norton AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Adobe Crack [All products].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\Erotic Screensaver.scr\Adobe Photoshop Full Version.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\7f0531cbaadefd63fb9c1f7ae51fc668\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\e2e42e6b0f65a618da8ab7235c27faf0\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\e2e42e6b0f65a618da8ab7235c27faf0\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\Visual Studio.NET.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\7f0531cbaadefd63fb9c1f7ae51fc668\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\SpyBot Removal.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\e2e42e6b0f65a618da8ab7235c27faf0\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\e2e42e6b0f65a618da8ab7235c27faf0\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\NOD32 AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\14.0.0.0__71e9bce111e9429c\Adobe Photoshop Full Version.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\14.0.0.0__71e9bce111e9429c\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\7f0531cbaadefd63fb9c1f7ae51fc668\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-detectionandsharingapi_31bf3856ad364e35_6.1.7600.16385_none_95980881f7dcdc33\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\14.0.0.0__71e9bce111e9429c\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\14.0.0.0__71e9bce111e9429c\Norton AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\14.0.0.0__71e9bce111e9429c\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\7f0531cbaadefd63fb9c1f7ae51fc668\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\microsoft.net\assembly\gac_msil\microsoft.csharp\Forum Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\SpyBot Search And Destroy.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\NOD32.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\14.0.0.0__71e9bce111e9429c\Visual Studio.NET.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\Adobe Photoshop CS3 [Crack].exe d56d03cf867c851d4e4c2d1aeb84567c.exe -
NTFS ADS 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\nc:\program files\common files\microsoft shared\ink\pt-pt\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files (x86)\common files\microsoft shared\smart tag\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files (x86)\common files\microsoft shared\smart tag\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\˜‰ˆc:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\osoft SharePoint Workspace 2010.lnkc:\programdata\microsoft\windows\start menu\programs\sharepoint\Brianna Banks and Jenna Jameson ScreenSaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\dvd maker\shared\dvdstyles\specialoccasion\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files (x86)\common files\microsoft shared\ink\hwrcustomization\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\˜‰ˆc:\program files (x86)\common files\microsoft shared\msinfo\it-it\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\êc:\program files (x86)\common files\microsoft shared\themes14\strtedge\uTorrent.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\tc:\program files (x86)\common files\microsoft shared\web server extensions\14\bin\1033\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\d].exec:\program files\dvd maker\shared\dvdsc:\program files (x86)\common files\microsoft shared\dao\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\)\common files\microsoft shared\dw\Kaspersky AntiVirus 2008 [Cracked].exec:\program files (x86)\common files\microsoft shared\equation\1033\Adobe Crack [All products].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\úÍ“c:\program files (x86)\common files\microsoftûc:\program files (x86)\common files\microsoft shared\themes14\aftrnoon\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\7b"v7b"vn Scc:\program files (x86)\common files\microsoft shared\web folders\WinRar.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ic:\program files\dvd maker\shared\dvdstyles\huecycle\Website Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ic:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\Website Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ž8Kw8ˆc:\program files (x86)\common files\microsoft shared\dao\NOD32 AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files (x86)\common files\microsoft shared\msinfo\fr-fr\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\mplates\csharp\Virus Scan.exec:\programdata\microsoft\windows\start menu\programs\sharepoint\Adobe Crack [All products].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\êc:\windows\syswow64\ime\shared\res\uTorrent.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\˜‰ˆc:\program files\common files\microsoft shared\ink\de-de\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\aftrnoon\WinZip.exec:\program u v\YaìYaìtìc:\program files (x86)\common files\microsoft shared\themes14\deepblue\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\exec:\program files (x86)\common files\microsoft shared\vgxc:\program files (x86)\common files\microsoft shared\vgx\NOD32 AntiVirus 2008.exe\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ic:\program files\common files\microsoft shared\ink\ru-ru\Website Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\êc:\program files (x86)\common files\microsoft shared\themes14\arctic\uTorrent.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\be Photoshop Full Version.exec:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\SpyBot Removal.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\71e9bce111e9429c\Norton AntiVirus 2008.exec:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\wc:\windows\syswow64\ime\shared\res\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\7b"v7b"vÐ ¡c:\program files (x86)\common files\microsoft shared\help\WinRar.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\icAssembliesc:\program files (x86)\common files\microsoft shared\msenv\Brianna Banks and Jenna Jameson ScreenSaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\äçc:\program files\common files\microsoft shared\ink\tr-tr\Cable Uncapper.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\@c:\program files\common files\microsoft shared\msinfo\Website Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ic:\program files\common files\microsoft shared\stationery\Website Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\dllc:\program files\common files\microsoft shared\vgx\Brianna Banks and Jenna Jameson ScreenSaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\dvd maker\shared\dvdstyles\pets\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ancec:\program files\dvd maker\shared\dvdstyles\performance\Adobe Photoshop Full Version.exe\Spyware Removal.exec:\program files\dvd maker\shared\dvdstyles\pets\Spyware Removal.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\.exec:\program files (x86)\common files\microsoft shared\web server extensions\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\äçc:\program files\common files\microsoft shared\textconv\it-it\Cable Uncapper.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\common files\microsoft shared\textconv\en-usc:\program files (x86)\common files\microsoft shared\textconv\en-us\Paris Hilton Screensaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\les (x86)\common files\microsoft shared\vba\vba7\Norton AntiVirus 2008.exec:\program files (x86)\common files\microsoft shared\vba\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\€“·ac:\windows\syswow64\ime\shared\Adobe Crack [All products].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\Üéc:\windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\Spyware Removal.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\dvd maker\shared\dvdstyles\babygirl\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\oldage\Wc:\program files\dvd maker\shared\dvdstyles\pets\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\Psc:\program files (x86)\common files\microsoft shared\dao\Spyware Removal.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\7b"v7b"v(Ÿ¡c:\program files (x86)\common files\microsoft shared\ink\1.0\WinRar.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\7b"v7b"v7235c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\WinRar.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\esx.dll.muic:\program files\common files\microsoft shared\ink\pt-br\Brianna Banks and Jenna Jameson ScreenSaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ic:\program files (x86)\common files\microsoft shared\help\1049\Website Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files (x86)\common files\microsoft shared\translat\arfr\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\bce111e9429c\uTorrent.exec:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\Cable Uncapper.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\msinfo\ja-jp\Windows Longhorn Beta.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\äçc:\program files (x86)\common files\microsoft shared\themes14\quad\Cable Uncapper.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ic:\program files (x86)\common files\microsoft shared\triedit\fr-fr\Website Hacker.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ºà¤ý1ÊyXñ®+Ê@PR¬eÚc:\windows\assembly\gac_32\microsoft.shac:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\14.0.0.0__71e9bce111e9429c\Paris Hilton Screensaver.scr d56d03cf867c851d4e4c2d1aeb84567c.exe File created \??\c:\program files\common files\microsoft shared\ink\cc:\program files\common files\microsoft shared\ink\da-dk\WinZip.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\Pêc:\program files\common files\microsoft shared\vgx\Cable Uncapper.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\äçc:\program files\dvd maker\shared\dvdstyles\resizingpanels\Cable Uncapper.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\äçc:\program files (x86)\common files\microsoft shared\help\1049\Cable Uncapper.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\Ò±Žc:\program files (x86)\common files\microsoftžc:\program files (x86)\common files\microsoft shared\msenv\publicassemblies\Kaspersky AntiVirus 2008 [Cracked].exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ž8Kw8ˆc:\program files (x86)\common files\microsoft shared\msinfo\de-de\NOD32 AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\514_none_98b24799b5d08c05c:\windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\Cisco Source.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\ž8Kw8ˆc:\program files (x86)\common files\microsoft shared\help\1028\NOD32 AntiVirus 2008.exec:\program files (x86)\common files\microsoft shared\help\1031\NOD32 AntiVirus 2008.exe d56d03cf867c851d4e4c2d1aeb84567c.exe File created C:\Users\Admin\AppData\Local\Temp\êc:\program files (x86)\common files\microsoft shared\msinfo\es-es\uTorrent.exe d56d03cf867c851d4e4c2d1aeb84567c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d56d03cf867c851d4e4c2d1aeb84567c.exe"C:\Users\Admin\AppData\Local\Temp\d56d03cf867c851d4e4c2d1aeb84567c.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
PID:2452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5d56d03cf867c851d4e4c2d1aeb84567c
SHA1a20e94bbbdd5c0f14a7ca5578785367df8090a74
SHA25655ec79e53cdc15127c847539dcbc14d157826e52aaea97ff8e76bd805eec1287
SHA51250cbe56bc89a98690cde762c8d7c830be14c5f4aa86360e650f572f40c7dcada5422b16eafd8a009d96300c9795e01dd247430dbef13628a2d9519d366567134