Technical Information
Modifies file system
Creates the following files
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\chatpage[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\css[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\minnitpage[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\error[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\v2b4487d741ca48dcbadcaf954e159fc61680799950996[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\fontawesome-5.15.4-all.min[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\chatpage[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\bootstrap.bundle-4.1.1[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\bootstrap-4.1.1.min[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\logjserror[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\main[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagestrings[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagetemplate[1]
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\jquery-3.3.1.min[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\httperrorpagesscripts[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\skip-link-focus-fix[1].js
- D:\windows\system32\config\software
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\warning[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\error[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\siteheader[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\down[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\bullet[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\info_48[1]
- D:\windows\system32\winevt\logs\security.evtx
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\background_gradient[1]
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\system
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\dnserrordiagoff_weboc[1]
- D:\users\user\ntuser.dat
- D:\users\user\ntuser.dat.log1
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\4063659[1].jpg
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\yawaspstyle[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\sitepress[1].js
- D:\users\user\appdata\local\temp\cabff54.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\genericons-regular-webfont[1].eot
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\u-440qyriqwlorhsvowk_l5-fczi[1].eot
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\css[1].txt
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\jquery[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\style[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\wp-emoji-release.min[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\language-selector[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\jquery-migrate.min[1].js
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_78d977680f0a854594ceee125bc2e56e
- D:\windows\system32\winevt\logs\system.evtx
- D:\users\user\appdata\local\temp\cab13a.tmp
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\ntv[1].txt
- D:\users\user\appdata\local\temp\tar41e.tmp
- D:\windows\system32\config\system.log1
- D:\users\user\appdata\local\temp\cab40e.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_78d977680f0a854594ceee125bc2e56e
- D:\users\user\appdata\local\temp\tar296.tmp
- D:\users\user\appdata\local\temp\cab295.tmp
- D:\users\user\appdata\local\temp\tar17b.tmp
- D:\users\user\appdata\local\temp\cab17a.tmp
- D:\users\user\appdata\local\temp\tar13b.tmp
- D:\users\user\appdata\local\temp\tarff55.tmp
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
Deletes the following files
- D:\users\user\appdata\local\temp\cabff54.tmp
- D:\users\user\appdata\local\temp\tarff55.tmp
- D:\users\user\appdata\local\temp\cab13a.tmp
- D:\users\user\appdata\local\temp\tar13b.tmp
- D:\users\user\appdata\local\temp\cab17a.tmp
- D:\users\user\appdata\local\temp\tar17b.tmp
- D:\users\user\appdata\local\temp\cab295.tmp
- D:\users\user\appdata\local\temp\tar296.tmp
- D:\users\user\appdata\local\temp\cab40e.tmp
- D:\users\user\appdata\local\temp\tar41e.tmp
Network activity
Connects to
- 'mo#3.co':80
- 'fo###.#oogleapis.com':80
- 'fo###.gstatic.com':80
- 'sl######gheartedpeevish.com':445
- 'sl######gheartedpeevish.com':139
- 'mi##it.chat':443
- 'go.##lasrv.com':445
- 'pu###est.com':445
- 'st####.##oudflareinsights.com':443
TCP
HTTP GET requests
- http://mo#3.co/wp-content/plugins/sitepress-multilingual-cms/res/css/language-selector.css?v=#####
- http://mo#3.co/wp-includes/js/wp-emoji-release.min.js?ve########
- http://mo#3.co/wp-content/themes/syntax/style.css?ve########
- http://mo#3.co/wp-includes/js/jquery/jquery.js?ve########
- http://fo###.#oogleapis.com/css?fa##################################################################################
- http://mo#3.co/wp-content/themes/syntax/fonts/genericons-regular-webfont.eot
- http://fo###.gstatic.com/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-fCZI.eot
- http://mo#3.co/wp-includes/js/jquery/jquery-migrate.min.js?ve#######
- http://mo#3.co/wp-content/plugins/sitepress-multilingual-cms/res/js/sitepress.js
- http://mo#3.co/wp-content/plugins/yawasp/yawaspStyle.css
- http://mo#3.co/wp-content/uploads/2014/08/4063659.jpg
- http://mo#3.co/wp-content/themes/syntax/js/siteheader.js?ve##########
- http://mo#3.co/wp-content/themes/syntax/js/skip-link-focus-fix.js?ve##########
Other
- 'mi##it.chat':443
- 'st####.##oudflareinsights.com':443
UDP
- DNS ASK mo#3.co
- DNS ASK fo###.#oogleapis.com
- DNS ASK fo###.gstatic.com
- DNS ASK sl######gheartedpeevish.com
- DNS ASK na####.propellerads.com
- DNS ASK mi##it.chat
- DNS ASK go.##lasrv.com
- DNS ASK pu###est.com
- DNS ASK st####.##oudflareinsights.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
