Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 13:34
Behavioral task
behavioral1
Sample
VirusShare_0bcadfa6300173d952219bf4674ac140.exe
Resource
win7-20240419-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare_0bcadfa6300173d952219bf4674ac140.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
VirusShare_0bcadfa6300173d952219bf4674ac140.exe
-
Size
7KB
-
MD5
0bcadfa6300173d952219bf4674ac140
-
SHA1
479a733f3fd375afbf607c132025faa336f5a33d
-
SHA256
a0f32da7313ba6c28cbb3635d841428fe467b99a4906f9b6f76d30bf36eaccb5
-
SHA512
9bcac81d76e9faf93417afd2e430c6c796e5c1a67605c0f2428cfeb706685b9bac1892dc682b5b1267eaf559a37d7bd16139b0937035a845cd50ff2f6cc82576
-
SSDEEP
96:WzFZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExaaLdTLIQi9VeMUA:GFzdrr1FG1WDCgmjPZaaRTlgVeMUA
Score
10/10
Malware Config
Signatures
-
Detected Xorist Ransomware 4 IoCs
resource yara_rule behavioral1/memory/2748-4769-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/2748-4770-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/2748-4771-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/2748-4772-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2748-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2748-4769-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2748-4770-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2748-4771-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2748-4772-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe" VirusShare_0bcadfa6300173d952219bf4674ac140.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmke.inf_amd64_neutral_3e4daa83122b1559\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\netevbda.inf_amd64_neutral_bab421df9c31cc81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\hcw72b64.inf_amd64_neutral_023772237d3a4ade\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_neutral_439e7d1dcac00aca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\migwiz\PostMigRes\data\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\adpahci.inf_amd64_neutral_b082e95ec9f8c3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcumd.inf_amd64_neutral_db43b26810939b3e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\mf.inf_amd64_neutral_b263d46928b97a9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\netirda.inf_amd64_neutral_93a886f96cea2847\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-COM-ComPlus-Setup-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_neutral_2ef24e9270d8b2a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtx64.inf_amd64_neutral_410e89ed86071c9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbus.inf_amd64_neutral_fca91999602b0343\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_neutral_560c956da9bcd8f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmatm2k.inf_amd64_neutral_64a8fb018ead55a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prnok302.inf_amd64_ja-jp_708c81a8b0ad8846\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00a.inf_amd64_neutral_565c5d04cc520c48\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00c.inf_amd64_neutral_53a58f4fd7d88575\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_neutral_1292ec506cfc26db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc0.inf_amd64_neutral_c24bcc939e6dfc23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\transfercable.inf_amd64_neutral_82f4c743c8996d67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_neutral_c81780c5dcabd0a0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_neutral_0383c5de75359695\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0021\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\averfx2hbh826d_noaverir_x64.inf_amd64_neutral_da2ba9e8a30dad14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\iirsp.inf_amd64_neutral_25c14d33af7f54f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_neutral_4a983035eaabe2f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_neutral_bc1469ba40fe2114\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\DVD Maker\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Common Files\System\msadc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DAO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\System\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Common Files\System\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Mail\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Java\jre7\lib\security\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.TraceSource\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..orkclient.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5be63c830afcc60b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..line-tool.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a3a873c4a692126e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_addinprocess32_b77a5c561934e089_6.1.7601.17514_none_df35b5ac03866e22\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ls-setspn.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_dc853d6125018cc2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\wow64_microsoft-windows-scripto_31bf3856ad364e35_6.1.7600.16385_none_a82c217d1fae50c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\diagnostics\system\Search\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..fcounters.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5330218a34995265\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cded2178c99fa9d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8374cbfabe45c127\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_prngt004.inf_31bf3856ad364e35_6.1.7600.16385_none_a0b67189fe7a0ea1\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_wcf-infocard_api_dll_31bf3856ad364e35_6.1.7600.16385_none_ffdbec6fc9513d29\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_wialx004.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5cc41f67794c42de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..es-drprov.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bb817730995c241b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..utilities.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3f402d2a88e586bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-utilman_31bf3856ad364e35_6.1.7600.16385_none_028006129290e443\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msieftp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_10345ad37a849405\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ssmanager.resources_31bf3856ad364e35_6.1.7600.16385_es-es_df30ea2c57d47f4a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-svc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8b200ca438fcb5b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_99424f610bd169de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_it-it_952b5672749e9ea2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-mdac-odbc-jet-ji32_31bf3856ad364e35_6.1.7600.16385_none_4e1138c1c6b8e855\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-photoacquire.resources_31bf3856ad364e35_6.1.7600.16385_de-de_391ee1fb79b65b5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0e8d75c5d7938376\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_wsdscdrv.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_588568e827bcb9d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8afb6612219902de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_f1584379b2973708\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-winhstb.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d1fc8aa78f5896ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-getmac.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a1aad48480a13372\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ncryptui-dll_31bf3856ad364e35_6.1.7601.17514_none_dfc1b9b1f9a420dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..rotection.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1b5e409ca9d9e556\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_prnkm005.inf_31bf3856ad364e35_6.1.7600.16385_none_5188943674b5f36d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4ef5f0e3f13760be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..vault-cpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_98aee6aa6e64421d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-wmiperf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fae76101a7728c8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..e-ehdebug.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f902fe1e93cf9fa0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-instmes.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_474ba944cba3120f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-wbemcore-dll_31bf3856ad364e35_6.1.7601.17514_none_3fe5b852ed7138b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..ilter-rtf.resources_31bf3856ad364e35_7.0.7600.16385_en-us_876ea0bdb3b0741b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-media-mp3acm_31bf3856ad364e35_6.1.7600.16385_none_6bab80e589fa397f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b5611bea97b62503\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0c7a787ee997b2c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..dlinehelp.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ffc128978cdc00c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-acluifilefoldertool_31bf3856ad364e35_6.1.7600.16385_none_49b88f2dc8d56917\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..vdsupport.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2f53f580db02150f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-multimon.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9a280ab632d6cd5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..lprinting.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fab184b0458c02b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_netvwifibus.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7bb34d7390074ab3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7a220275b218b933\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..filercore.resources_31bf3856ad364e35_8.0.7600.16385_de-de_3146b49a9601486e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\wow64_microsoft-windows-r..ry-editor.resources_31bf3856ad364e35_6.1.7600.16385_en-us_611ad8f550d1094a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..r-wmerror.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4837610e516eb5c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..topeerdrt.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b270c0e96d215fb8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7601.17514_none_eedf2e0751865eb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1107dcb1e9c5b5e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f1d1bd913694f1d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ff29b0518391dafe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_microsoft-windows-wsd-challengecomponent_31bf3856ad364e35_6.1.7601.17514_none_267f132f01972084\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\x86_wpf-presentationcffrasterizernative_31bf3856ad364e35_6.1.7600.16385_none_c96bb53eefa606a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_ehstorcertdrv.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4e590de0dff9747b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..datastore.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_11f7e2e40b8be7e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..win32-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ff9b39093356167f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe File created C:\Windows\winsxs\amd64_wiabr004.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4fdc831e7ae5b86d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_0bcadfa6300173d952219bf4674ac140.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell VirusShare_0bcadfa6300173d952219bf4674ac140.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe" VirusShare_0bcadfa6300173d952219bf4674ac140.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd VirusShare_0bcadfa6300173d952219bf4674ac140.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\DefaultIcon VirusShare_0bcadfa6300173d952219bf4674ac140.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe,0" VirusShare_0bcadfa6300173d952219bf4674ac140.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open\command VirusShare_0bcadfa6300173d952219bf4674ac140.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZEDXTPPUGUDHYFG" VirusShare_0bcadfa6300173d952219bf4674ac140.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG VirusShare_0bcadfa6300173d952219bf4674ac140.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\ = "CRYPTED!" VirusShare_0bcadfa6300173d952219bf4674ac140.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open VirusShare_0bcadfa6300173d952219bf4674ac140.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_0bcadfa6300173d952219bf4674ac140.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_0bcadfa6300173d952219bf4674ac140.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD50f8f1bcb3bc186c96cc2650fe18652cc
SHA1390735204b42718da68e76c38716d76ac5fc64af
SHA256b6f08bae98a0d74b6fc972b3a646c444aeda602b48bc67aa83f048784e76b6f8
SHA512f150a2ac8ee1cd7f9d23d7ca68adc4478824691363e86a4a37e60156ebfee7b629ec5d0df454a1ae16cc788bcd0f1eb2d056a8afa8f5b018164b1b8f2bebccfe