IOC Report
9MgoW3Y1ti.exe

loading gif

Files

File Path
Type
Category
Malicious
9MgoW3Y1ti.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\ProgramData\UID Finder 6.11.66\UID Finder 6.11.66.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\Qt5OpenGL.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\Qt5WinExtras.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\Qt5Xml.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\QtAVWidgets1.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\avdevice-58.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-1KIT8.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-39U3O.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-3D4M0.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-4KSHT.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-823LG.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-EMQ3A.tmp
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-J8S40.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-PU0LK.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-TTPUD.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-U97AK.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-VS29P.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\libcurl.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\libeay32.dll (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\libmp3lame.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\mousehelper.dll (copy)
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\openh264.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\recordpadsoundrecorder32.exe
PE32 executable (GUI) Intel 80386, for MS Windows
modified
malicious
C:\Users\user\AppData\Local\RecordPad Sound Recorder\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\is-M9SH4.tmp\_isetup\_RegDLL.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\is-M9SH4.tmp\_isetup\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\is-M9SH4.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Temp\is-O879I.tmp\9MgoW3Y1ti.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\ProgramData\uit_66.dat
Non-ISO extended-ASCII text, with no line terminators
dropped
C:\ProgramData\urc_66.dat
data
dropped
C:\ProgramData\ures-a.dat
ASCII text, with no line terminators
dropped
C:\ProgramData\ures-b.dat
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\Qt5Svg.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-377H9.tmp
data
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-3VSKS.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-DL0CV.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-G6H1M.tmp
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-HD7FV.tmp
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-J8GD3.tmp
ASCII text
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-MH9PV.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\is-S4BNJ.tmp
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\msvcp120.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\msvcp140.dll (copy)
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\msvcp140_1.dll (copy)
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\RecordPad Sound Recorder\msvcr120.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped