Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 19:38
Behavioral task
behavioral1
Sample
VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe
-
Size
12KB
-
MD5
02d8757eea9192313f9d5888a5bc1bc1
-
SHA1
a34044e9316c5d691cd73dd699210b3f10832fe0
-
SHA256
fc3bc3a24aaf95cb44ab5e9b8f8b9da0bdcbab344047696efabc15cf666cb03d
-
SHA512
d75b96a71f361180c03560d03771e341239f745b796830afc21bdde498994f75f1ddf3d206b00e43f1733e8edd7b97e8e0dfea2d119d0cc5528608972cad9eda
-
SSDEEP
192:y/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRM0ICU:yebFNw4Pk1itKkpAjjI2Ypdm0nU
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe" VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\mpio.inf_amd64_neutral_0c74c0f95001b61c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk00.inf_amd64_neutral_9c0c35afdddc16d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\tsusbhub.inf_amd64_neutral_c67606b3f53ae4d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\migration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_neutral_7c21481229e1e66c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_neutral_54f2470c084714e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\wdmaudio.inf_amd64_neutral_423894ded0ba8fdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_neutral_6708ad28050a6765\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr00a.inf_amd64_neutral_6033065925bcc882\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_neutral_988a34fc912eab54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_neutral_4616c3de1949be6d\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\wd.inf_amd64_neutral_759109899b486d47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\atiriol6.inf_amd64_neutral_bde34ad5722cca75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\faxcn002.inf_amd64_neutral_3d392ccc357e04db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhay2.inf_amd64_neutral_ff250f861d941dd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\prnok302.inf_amd64_ja-jp_708c81a8b0ad8846\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\el-GR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\iirsp.inf_amd64_neutral_25c14d33af7f54f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_neutral_4c228493af8567bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\usbvideo.inf_amd64_neutral_836a6716cd56c692\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_neutral_46f466c9e68abb4a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00d.inf_amd64_neutral_2c3623fa97b0c28e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbtmdm.inf_amd64_neutral_2e4da8629fc5904e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc10.inf_amd64_neutral_2c5d0c618dbfaf2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc007.inf_amd64_neutral_2df575afa0f7d35f\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcmdm.inf_amd64_neutral_af49d2f3ffa12116\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\hpoa1nd.inf_amd64_neutral_cf39c48277e038de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\netxfx64.inf_amd64_neutral_3336ecb2950fdc45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky306.inf_amd64_ja-jp_97f0de39317f6837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0005\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\ado\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Mail\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Microsoft Games\Hearts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Defender\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Common Files\System\ado\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Journal\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Media Player\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Media Player\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-r..l-cmdline.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0264d59f5968ba9e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\wow64_subsystem-for-unix-..lications.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e166d0da2c48b6ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_aspnet_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_a5a135380060b978\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-compact.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2983350f95173898\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..centercpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e56018e2701d6be6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..standardportmonitor_31bf3856ad364e35_6.1.7600.16385_none_a39cec6c3a968733\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Iden1fe87377#\4c6cab2aa8b33a65a6b71a173f72767f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c80cf1d4b4cdf5c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_prngt002.inf_31bf3856ad364e35_6.1.7600.16385_none_9fa44d1fcc3d95cf\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-icm-base.resources_31bf3856ad364e35_6.1.7600.16385_es-es_47b30300d9b33c14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..erclasses.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4858dcd023a624b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-shunimpl_31bf3856ad364e35_6.1.7601.17514_none_b3bc7baa4af52181\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..tfmonitor.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6ca8fae60b4d39ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\SrpUxSnapIn\593c2939737f10fc236c7b4de35271bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_server-help-chm.netcfg.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a97ab7bef6ddecc7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_3946bb08402dcd51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..atahelper.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0e07ac8872b57b97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..-binaries.resources_31bf3856ad364e35_6.1.7601.17514_de-de_ae41096fd71de710\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f9ab0da3ad8751ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_disk.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_913bdc7fbaa9c901\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..roperties.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9b038ec848ae2d9e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_6.1.7600.16385_de-de_510aeb40eba1fef7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\msil_microsoft.backgroun..transfer.management_31bf3856ad364e35_6.1.7600.16385_none_91d0935a068ac0c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-msmpeg2enc_31bf3856ad364e35_6.1.7601.17514_none_0b450351a4424f06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-storprop_31bf3856ad364e35_6.1.7600.16385_none_8247a61e4a9abc04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_security-malware-wi..-defender.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ed16723faac5f5ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sigverif.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a4de0e088cc6cf6d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-dims.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b83336ee909fadba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-e..extension.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0ea56a2806131ab1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft.windows.s..rt_driver.resources_31bf3856ad364e35_6.1.7600.16385_it-it_399ef387d4797613\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.7600.16385_en-us_996035be5f5e2c15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_mmcss.resources_31bf3856ad364e35_6.1.7600.16385_es-es_098ab71a511b4f2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ncdprop.resources_31bf3856ad364e35_6.1.7600.16385_it-it_13c56931c2e66809\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_mdmbr00a.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6350318f60f895fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..trolpanel.resources_31bf3856ad364e35_8.0.7601.17514_fr-fr_3dedc4e168c6add3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..omplus-ui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_253c597282301dcb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\msil_microsoft.powershell.editor_31bf3856ad364e35_6.1.7601.17514_none_e1afc4bb6ff47625\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..tptracing.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b89ad89ebafc0762\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\addins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehskb_31bf3856ad364e35_6.1.7601.17514_none_a8a886f06bf01c83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskbarcpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d0f4b03a5b80da85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-mfplat.resources_31bf3856ad364e35_6.1.7600.16385_it-it_915d603c61c65391\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-font-truetype-irisupc_31bf3856ad364e35_6.1.7600.16385_none_2449677664faf8df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_wdmaudio.inf_31bf3856ad364e35_6.1.7600.16385_none_bc5c4aba33d6af68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..it-snapin.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4d38d5ac24a19b78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_cdrom.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ebbee9308263bd4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..dlinehelp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d3e55b499e2f8bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7600.16385_it-it_051cb38514053e82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..idebarres.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2282f6e028a183e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e27e1f20be009114\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-ntlanman.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6a6825ad66f6db77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dcom-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ba2db6fbd8860506\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-grouppolicy-gptext_31bf3856ad364e35_6.1.7600.16385_none_9344be31a8b7d6bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..-whitebox.resources_31bf3856ad364e35_6.1.7600.16385_es-es_39d79459fc4547c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_de-de_5b5a6afc3f413c1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-hgroupp.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_098664865f1aa6f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_prnky004.inf_31bf3856ad364e35_6.1.7600.16385_none_3dd58b93065f62f8\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_battery.inf.resources_31bf3856ad364e35_6.1.7601.17514_it-it_4fc28b4f1abef068\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_wpf-presentationframework.aero_31bf3856ad364e35_6.1.7600.16385_none_8e78b13e22425483\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..omponent-pkeyconfig_31bf3856ad364e35_6.1.7601.17514_none_4d16a37a40d8201b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tapi3.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_48a21249766a92e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe File created C:\Windows\winsxs\x86_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a1b24ce63b235c75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "KDWGUABUGOUDFYP" VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\ = "CRYPTED!" VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\DefaultIcon VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe,0" VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open\command VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe" VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_02d8757eea9192313f9d5888a5bc1bc1.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295B
MD5481efe329c3e9a73708ad487b301a620
SHA144572ce4a8b427d5cec59667be23eb43cd379196
SHA256eac9b59ef3964a8de6d4f90c20c44575c4e691eddd391e8c0a579f53a17f8ac1
SHA512c37cf59c46b9990851e7ec4a3becfab649250416027e1929fee731a244770d66b3df93b447ff08cd1518164b9215d493960030e427d771c13920e731f63ea092