IOC Report
tOniaJ21lj.exe

loading gif

Files

File Path
Type
Category
Malicious
tOniaJ21lj.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\ProgramData\UID Finder 6.11.66\UID Finder 6.11.66.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\Qt5OpenGL.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\Qt5WinExtras.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\Qt5Xml.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\QtAVWidgets1.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\avdevice-58.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-0C056.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-6P98M.tmp
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-8ECK7.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-JNDNQ.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-KI2RB.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-O2PKH.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-PRP4U.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-RV2D1.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-UCHQL.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-UTKLG.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-VDBC5.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\libcurl.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\libeay32.dll (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\libmp3lame.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\mousehelper.dll (copy)
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\openh264.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\recordpadsoundrecorder32.exe
PE32 executable (GUI) Intel 80386, for MS Windows
modified
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\is-A11IR.tmp\tOniaJ21lj.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\is-NO26A.tmp\_isetup\_RegDLL.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\is-NO26A.tmp\_isetup\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\is-NO26A.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\ProgramData\uit_66.dat
Non-ISO extended-ASCII text, with no line terminators
dropped
C:\ProgramData\urc_66.dat
data
dropped
C:\ProgramData\ures-a.dat
ASCII text, with no line terminators
dropped
C:\ProgramData\ures-b.dat
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\Qt5Svg.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-BRGIM.tmp
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-C4R5U.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-EAHN0.tmp
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-FR4FM.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-K3HBS.tmp
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-KU10K.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-L7B6O.tmp
ASCII text
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-OIVVM.tmp
data
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\msvcp120.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\msvcp140.dll (copy)
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\msvcp140_1.dll (copy)
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\msvcr120.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped