Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\audiodrivermaintenance
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im chrome.exe
- '<SYSTEM32>\taskkill.exe' /f /im brave.exe
- '<SYSTEM32>\taskkill.exe' /f /im msedge.exe
- '<SYSTEM32>\taskkill.exe' /f /im opera.exe
- '<SYSTEM32>\taskkill.exe' /f /im firefox.exe
- '<SYSTEM32>\taskkill.exe' /f /im librewolf.exe
- '<SYSTEM32>\taskkill.exe' /f /im waterfox.exe
- '<SYSTEM32>\taskkill.exe' /f /im zen.exe
- '<SYSTEM32>\taskkill.exe' /f /im vivaldi.exe
- '<SYSTEM32>\taskkill.exe' /f /im browser.exe
- '<SYSTEM32>\taskkill.exe' /f /im QQBrowser.exe
- '<SYSTEM32>\taskkill.exe' /f /im 360chrome.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- nul
- %TEMP%\audiodriversetup.elevated
- %LOCALAPPDATA%\microsoft\windows\audiodriver\audiodriversetup.exe
- %TEMP%\audiodriversetup_notify_admin_ok
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\release
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\classlist
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\fontconfig.bfc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\fontconfig.properties.src
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\jawt.lib
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\jrt-fs.jar
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\jvm.cfg
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\jvm.lib
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\modules
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\psfont.properties.ja
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\psfontj2d.properties
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\tzdb.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\tzmappings
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\security\blocked.certs
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\security\cacerts
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\lib\security\public_suffix_list.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\jdk.zipfs\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\jdk.zipfs\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\jdk.crypto.cryptoki\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\jdk.crypto.cryptoki\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\bcel.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\dom.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\jcup.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\schema10part1.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\schema10part2.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\xalan.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\xerces.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\xhtml10.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\xhtml10schema.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\xhtml11.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\xhtml11schema.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\xmlspec.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.xml\xmlxsd.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.transaction.xa\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.transaction.xa\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.sql\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.sql\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.prefs\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.prefs\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.net.http\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.net.http\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.logging\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.logging\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\colorimaging.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\freetype.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\giflib.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\harfbuzz.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\jpeg.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\lcms.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\libpng.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.desktop\mesa3d.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.datatransfer\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.datatransfer\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\c-libutl.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\cldr.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\copyright
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\icu.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\license
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\public_suffix.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\siphash.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\unicode.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\wepoll.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\legal\java.base\zlib.md
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\jaxp-strict.properties.template
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\jaxp.properties
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\logging.properties
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\net.properties
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\sound.properties
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\security\java.security
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\security\policy\readme.txt
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\security\policy\unlimited\default_local.policy
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\security\policy\unlimited\default_us_export.policy
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\security\policy\limited\default_local.policy
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\security\policy\limited\default_us_export.policy
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\conf\security\policy\limited\exempt_local.policy
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-console-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-console-l1-2-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-datetime-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-debug-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-fibers-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-fibers-l1-1-1.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-file-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-kernel32-legacy-l1-1-1.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-memory-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-sysinfo-l1-2-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\awt.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\fontmanager.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\freetype.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\j2pkcs11.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\java.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\java.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\javajpeg.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\javaw.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\jawt.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\jimage.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\jli.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\jsound.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\keytool.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\lcms.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\mlib_image.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\msvcp140.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\net.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\nio.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\prefs.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\splashscreen.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\syslookup.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\ucrtbase.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\vcruntime140.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\vcruntime140_1.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\verify.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\zip.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\server\jvm.dll
- %TEMP%\hsperfdata_user\5340
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\83aa4cc77f591dfc2374580bbd95f6ba_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %TEMP%\vv\80tq9x8k\logs\logs.txt
- %TEMP%\jna-3599307\jna13874794332976851607.dll
- %TEMP%\history_808c8d76d54ff5fb.db
- %TEMP%\vv\80tq9x8k\sqlite-native\sqlite-3.45.1.0-d0a68d7d-a437-4777-929d-13026a821297-sqlitejdbc.dll
- %TEMP%\vv\80tq9x8k\browser-datas\microsoft_edge\default\history.txt
- %TEMP%\login_data_2ebb473c3e6dcdc4.db
- %TEMP%\vv\80tq9x8k\browser-datas\microsoft_edge\default\passwords.txt
- %TEMP%\web_data_96754d16381849bc.db
- %TEMP%\web_data_9d1fe8f5d7cb595a.db
- %TEMP%\history_9615a11b1768ebed.db
- %TEMP%\vv\80tq9x8k\browser-datas\google_chrome\default\history.txt
- %TEMP%\cookies_7a53c3951b846444.db
- %TEMP%\login_data_65d5fa8e604b95f8.db
- %TEMP%\vv\80tq9x8k\browser-datas\google_chrome\default\passwords.txt
- %TEMP%\web_data_0044d2ae11642349.db
- %TEMP%\web_data_000dc5044d82b2af.db
- %TEMP%\history_28889bb6b686ffc1.db
- %TEMP%\vv\80tq9x8k\browser-datas\opera\opera stable\history.txt
- %TEMP%\login_data_faed186c6f35275b.db
- %TEMP%\vv\80tq9x8k\browser-datas\opera\opera stable\passwords.txt
- %TEMP%\web_data_28171ecf26e03d64.db
- %TEMP%\web_data_cfef1c74a66fbfd7.db
- %TEMP%\key4_aa4e9a75317bc88f.db
- %TEMP%\cookies_16bef88fe94af208.db
- %TEMP%\cookies_16bef88fe94af208.db-shm
- %TEMP%\vv\80tq9x8k\browser-datas\firefox\dnyauhh1.default-release\cookies.txt
- %TEMP%\vv\80tq9x8k\browser-datas\firefox\dnyauhh1.default-release\passwords.txt
- %TEMP%\places_7f1e69a74f738ea9.db
- %TEMP%\places_7f1e69a74f738ea9.db-shm
- %TEMP%\vv\80tq9x8k\browser-datas\firefox\dnyauhh1.default-release\bookmarks.txt
- %TEMP%\places_30a2f0d0c5b1619f.db
- %TEMP%\places_30a2f0d0c5b1619f.db-shm
- %TEMP%\vv\80tq9x8k\browser-datas\firefox\dnyauhh1.default-release\history.txt
- %TEMP%\formhistory_58d37944372230a6.db
- %TEMP%\vv_firefox_12379756781334474242.db
- %TEMP%\vv_firefox_12379756781334474242.db-shm
- %TEMP%\vv_firefox_13111439569708426856.db
- %TEMP%\vv_firefox_13111439569708426856.db-shm
- %TEMP%\vv\80tq9x8k\browser-datas\tokens\all_tokens.txt
- %TEMP%\vv\80tq9x8k\browser-datas\tokens\plain.txt
- %TEMP%\vv\80tq9x8k\browser-datas\tokens\tokens.txt
- %TEMP%\vv\80tq9x8k\browser-datas\all_passwords.txt
- %TEMP%\vv\80tq9x8k\vestigia navigandi.zip
Deletes following files that it created itself
- %TEMP%\jna-3599307\jna13874794332976851607.dll
- %TEMP%\history_808c8d76d54ff5fb.db
- %TEMP%\login_data_2ebb473c3e6dcdc4.db
- %TEMP%\web_data_96754d16381849bc.db
- %TEMP%\web_data_9d1fe8f5d7cb595a.db
- %TEMP%\history_9615a11b1768ebed.db
- %TEMP%\cookies_7a53c3951b846444.db
- %TEMP%\login_data_65d5fa8e604b95f8.db
- %TEMP%\web_data_0044d2ae11642349.db
- %TEMP%\web_data_000dc5044d82b2af.db
- %TEMP%\history_28889bb6b686ffc1.db
- %TEMP%\login_data_faed186c6f35275b.db
- %TEMP%\web_data_28171ecf26e03d64.db
- %TEMP%\web_data_cfef1c74a66fbfd7.db
- %TEMP%\key4_aa4e9a75317bc88f.db
- %TEMP%\cookies_16bef88fe94af208.db-shm
- %TEMP%\cookies_16bef88fe94af208.db
- %TEMP%\places_7f1e69a74f738ea9.db-shm
- %TEMP%\places_7f1e69a74f738ea9.db
- %TEMP%\places_30a2f0d0c5b1619f.db-shm
- %TEMP%\places_30a2f0d0c5b1619f.db
- %TEMP%\formhistory_58d37944372230a6.db
- %TEMP%\vv_firefox_12379756781334474242.db-shm
- %TEMP%\vv_firefox_12379756781334474242.db
- %TEMP%\vv_firefox_13111439569708426856.db-shm
- %TEMP%\vv_firefox_13111439569708426856.db
- %TEMP%\vv\80tq9x8k\browser-datas\all_passwords.txt
- %TEMP%\vv\80tq9x8k\browser-datas\firefox\dnyauhh1.default-release\bookmarks.txt
- %TEMP%\vv\80tq9x8k\browser-datas\firefox\dnyauhh1.default-release\cookies.txt
- %TEMP%\vv\80tq9x8k\browser-datas\firefox\dnyauhh1.default-release\history.txt
- %TEMP%\vv\80tq9x8k\browser-datas\firefox\dnyauhh1.default-release\passwords.txt
- %TEMP%\vv\80tq9x8k\browser-datas\google_chrome\default\history.txt
- %TEMP%\vv\80tq9x8k\browser-datas\google_chrome\default\passwords.txt
- %TEMP%\vv\80tq9x8k\browser-datas\microsoft_edge\default\history.txt
- %TEMP%\vv\80tq9x8k\browser-datas\microsoft_edge\default\passwords.txt
- %TEMP%\vv\80tq9x8k\browser-datas\opera\opera stable\history.txt
- %TEMP%\vv\80tq9x8k\browser-datas\opera\opera stable\passwords.txt
- %TEMP%\vv\80tq9x8k\browser-datas\tokens\all_tokens.txt
- %TEMP%\vv\80tq9x8k\browser-datas\tokens\plain.txt
- %TEMP%\vv\80tq9x8k\browser-datas\tokens\tokens.txt
- %TEMP%\vv\80tq9x8k\logs\logs.txt
- %TEMP%\vv\80tq9x8k\sqlite-native\sqlite-3.45.1.0-d0a68d7d-a437-4777-929d-13026a821297-sqlitejdbc.dll
- %TEMP%\vv\80tq9x8k\vestigia navigandi.zip
Substitutes the following files
- %TEMP%\vv\80tq9x8k\logs\logs.txt
Network activity
Connects to
- 'vv###########i.husenchristina7256.workers.dev':443
TCP
Other
- 'vv###########i.husenchristina7256.workers.dev':443
UDP
- DNS ASK vv###########i.husenchristina7256.workers.dev
- DNS ASK so####xdhaha.zip
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\javaw.exe' --enable-native-access=ALL-UNNAMED -Dorg.sqlite.tmpdir=%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Audio_4i1ok_812_1783362529063\sqlite-native -DAGENT_PASSWORD=yd_7JY9Al17X2BPV91obFmkm -DAGENT...
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /Query /TN "Microsoft\Windows\AudioDriverMaintenance""
- '<SYSTEM32>\schtasks.exe' /Query /TN "Microsoft\Windows\AudioDriverMaintenance"
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /Create /F /TN "Microsoft\Windows\AudioDriverMaintenance" /TR "\"%LOCALAPPDATA%\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe\"" /SC ONLOGON /RL HIGHEST"
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Microsoft\Windows\AudioDriverMaintenance" /TR "\"%LOCALAPPDATA%\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe\"" /SC ONLOGON /RL HIGHEST
- '<SYSTEM32>\tar.exe' -xzf sysaudio.tar.gz
- '<SYSTEM32>\tasklist.exe' /fi "imagename eq LsaIso.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "$avs = @(); try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | ForEach-Object { if ($_.displayName) { $avs += $_.displayN...
- '<SYSTEM32>\wbem\wmic.exe' process where name='firefox.exe' get ExecutablePath /format:list
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /Query /TN "Microsoft\Windows\AudioDriverMaintenance""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /Create /F /TN "Microsoft\Windows\AudioDriverMaintenance" /TR "\"%LOCALAPPDATA%\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe\"" /SC ONLOGON /RL HIGHEST"' (with hidden window)
- '<SYSTEM32>\tar.exe' -xzf sysaudio.tar.gz' (with hidden window)
- '%LOCALAPPDATA%\microsoft\windows\<INETFILES>\audio_4i1ok_812_1783362529063\jre\bin\javaw.exe' --enable-native-access=ALL-UNNAMED -Dorg.sqlite.tmpdir=%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Audio_4i1ok_812_1783362529063\sqlite-native -DAGENT_PASSWORD=yd_7JY9Al17X2BPV91obFmkm -DAGENT...' (with hidden window)