Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
ORDER AND CATALOG 01.bat
|
ASCII text, with very long lines (7537), with no line terminators
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
|
Extensible storage engine DataBase, version 0x620, checksum 0xb65c030d, page size 16384, DirtyShutdown, Windows version 10.0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltzeudcs.yp1.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YR072N3QKOFFN5LUN1BZ.temp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Suspendibility.Lum
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
|
JSON data
|
dropped
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
cohabitais.ru.com
|
103.83.194.50
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
103.83.194.50
|
cohabitais.ru.com
|
United States
|
||
|
127.0.0.1
|
unknown
|
unknown
|
||
|
23.218.208.109
|
unknown
|
United States
|