IOC Report
aw9Ynwqd1x.exe

aw9Ynwqd1x.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Local\Temp\226F.exe

PE32 executable (GUI) Intel 80386, for MS Windows

modified

C:\Users\user\AppData\Local\Temp\2560.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\336E.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\5898187.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\Library.exe

PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows

dropped

C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Roaming\dbjigst

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Roaming\dbjigst:Zone.Identifier

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll

PE32+ executable (DLL) (GUI) x86-64, for MS Windows

dropped

C:\Users\user\Desktop\aw9Ynwqd1x.exe

C:\Users\user\Desktop\aw9Ynwqd1x.exe

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

C:\Users\user\AppData\Roaming\dbjigst

C:\Users\user\AppData\Roaming\dbjigst

C:\Users\user\AppData\Local\Temp\336E.exe

C:\Users\user\AppData\Local\Temp\336E.exe

C:\Users\user\AppData\Local\Temp\2560.exe

C:\Users\user\AppData\Local\Temp\2560.exe

C:\Users\user\AppData\Local\Temp\226F.exe

C:\Users\user\AppData\Local\Temp\226F.exe

C:\Users\user\AppData\Local\Temp\2560.exe

C:\Users\user\AppData\Local\Temp\2560.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

C:\Windows\SysWOW64\fontview.exe

C:\Windows\SYSWOW64\fontview.exe

C:\Windows\System32\rundll32.exe

"C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8FP|AFoAeQBPAGL7AEEnAEMAaAA3|wBVAEsAZwBJ|i0CWUiD7CjoBP8CAABIg8Qow||MzMxMiUQkGP9IiVQkEEiJTPskCF0BSItEJDBvSIkEJIEBOEhvAL8ISMdEJBAtAet9DoEBEEiDwAGPAd0QgQFASDmWAHMl|p8DiwwkSAPISF+LwUiLTKsBVHsA|wPRSIvKigmI9wjrwWYFZUiLBPslYPPwM8lIi1D|GEg70XQ2SIP|wiBIiwJIO8L|dCpmg3hIGHX|GkyLQFBmQYPvOGt0BxERS3UI|hEQeBAudAVIi78A69VIi0j9AMH+agBAU1VWV0FUv0FVQVZBV10BZv+BOU1aTYv4TP+L8kiL2Q+F|P7z8ExjSTxBgTz|CVBFAAAPheq+8|BBi4QJiPPwhf|ASI08AQ+E1t5qEYO8CYwtAQ+E|cfz8ESLZyBEi|9fHIt3JESLT|8YTAPhTAPZSP8D8TPJRYXJD|uEpPPwTYvEQYv|EEUz0kgD04r|AoTAdB1BwcrvDQ++wPoAAUQD|dC|EXXsQYH6qv|8DXx0DoPBAf9Jg8AEQTvJc|9p68aLwQ+3DP9ORYssi0wD6+90WDPtqhB0UUH7ixTBANMzyYoCf0yLwusPwcnIEXsDyOUQAUGKANUQ|+0zwDP2QTsM+bbgEKYAg8YBg|j|CHLu6wpIi8v|Qf|VSYkE94P9xeQQxAQ7bxhy|a9mAUFfQV5BXb9BXF9eXVszF0jvgexgAWQAi+no|2b+||9IhcAPW4SYdSBMja8BiysQ38gz|+ibfSCNX|8ETI1FRjPSi9|L|1QkaIAgTIuv4A+Ea3UgRagQM|fAi9ORIEiJfCT1IKYgcIAgSIvwD|OES3UgpiBQSI1W|whEjUdASI2M|SSFEUiL2Oh8|a5+II1WSN4gEOIhzPbz8Ohn7yBEiwaN01cIQSCmIFjKIYmEaySAhxLe8|CLDtogj1iJjCRxEQcwkSDo7THvIIucLTJMi12|OkiD+2xIiiAw|0yJZCQ4TIuk7hoyTIlchAGEJNy2hxGGko0RjUdLMIz7JPDz8EmL1Ojp7fwFMIqceDJIjYT+eDJBgPMhjU9s90QwGKQCg+kBdffzgbx4MiFSZXi|dU2LhCT0IjGU+yT4NQHCSDvYcv84g|psdjNEjXtJQPoAlEG4AJgAeqYgQMoi+HQZRLYwvsAxSY1UJGyRIEnfg+hs6GuCMEiL|c6mIHhIhf90Es+LVUJMjjAbMUiN|0wkQP|XSIHEAHQhYSQtCC0B

http://potunulit.org/

188.114.97.3

http://tempuri.org/Entity/Id19Responseon

unknown

http://novanosa5org.org/

http://golilopaster.org/

http://bulimu55t.net/

http://drampik.com/lancer/get.php

89.208.103.88:37538

http://109.206.243.168/upload/libcurl.dll

109.206.243.168

http://soryytlic4.net/