Technical Information
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{78821544-1544-1544-1544-788215441544}
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
- 7d0e.tmp.exe
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %TEMP%\4dd3.tmp
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\23af.tmp.exe
- %APPDATA%\edgecp\microsoftedgecps.exe
- %ALLUSERSPROFILE%\q2u1v8x1w0u1v8x1w0\igec10xurec9.ige
- %TEMP%\1231.tmp.exe
- %TEMP%\f7cd.tmp.exe
- %LOCALAPPDATA%low\wxxth3wdmxm.zip
- %LOCALAPPDATA%low\machineinfo.txt
- %TEMP%\e1eb.tmp.exe
- %TEMP%\db17.tmp.exe
- %LOCALAPPDATA%low\5gmvdu0xn-shm
- %LOCALAPPDATA%low\5gmvdu0xn
- %LOCALAPPDATA%low\gksx9feji-shm
- %LOCALAPPDATA%low\gksx9feji
- %LOCALAPPDATA%low\firefox_urls.txt
- %LOCALAPPDATA%low\mehizbf0a-shm
- %LOCALAPPDATA%low\mehizbf0a
- %TEMP%\b177.tmp.exe
- %LOCALAPPDATA%low\fraqbc8ws-shm
- %LOCALAPPDATA%low\fraqbc8ws
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-memory-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-profile-l1-1-0.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\microsoftedgecps.lnk
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processenvironment-l1-1-0.dll
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\nsx83d0.tmp\system.dll
- %APPDATA%\55292128
- %APPDATA%\microsoft\windows\start menu\programs\zsadsadsad\dsffffffdd.lnk
- %APPDATA%\microsoft\windows\start menu\programs\zsadsadsad\qasdadsdsd.lnk
- %LOCALAPPDATA%low\bbsqwy6yhk
- %LOCALAPPDATA%low\gxix4a2dre
- %LOCALAPPDATA%low\exuieaoeii
- %LOCALAPPDATA%low\3solbph71y
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%low\x3cf3ednhm
- %LOCALAPPDATA%low\rywtiizs2t
- %LOCALAPPDATA%low\1xvpfvjcrg
- %LOCALAPPDATA%low\fraqbc8wsa
- %TEMP%\7d0e.tmp.exe
- %LOCALAPPDATA%low\sqlite3.dll
- %TEMP%\76b7.tmp.exe
- %TEMP%\6b60.tmp.exe
- %TEMP%\5a5f.tmp.exe
- %APPDATA%\cwufceu
- %APPDATA%\ervdhug
- %LOCALAPPDATA%low\rqf69azbla
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ih7oe4ur9pw5zj0o.zip
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nssdbm3.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nssckbi.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nss3.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\msvcp140.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozmapi32_inuse.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozmapi32.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozglue.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mapiproxy_inuse.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mapiproxy.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\libegl.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\lgpllibs.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ldif60.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ldap60.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ia2marshal.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\freebl3.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\breakpadinjector.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\accessiblemarshal.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\accessiblehandler.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\vcruntime140.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ucrtbase.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\softokn3.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\qipcap.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\prldap60.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processthreads-l1-1-0.dll
- %APPDATA%\edgecp\id.conf
- %APPDATA%\ervdhug
- %APPDATA%\cwufceu
- %LOCALAPPDATA%low\fraqbc8wsa
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\breakpadinjector.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\freebl3.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ia2marshal.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ucrtbase.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\softokn3.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\qipcap.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\prldap60.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nssdbm3.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nssckbi.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\nss3.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\msvcp140.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozmapi32_inuse.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozmapi32.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mozglue.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mapiproxy_inuse.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\mapiproxy.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\libegl.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\lgpllibs.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ldif60.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ldap60.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\vcruntime140.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%low\5gmvdu0xn-shm
- %LOCALAPPDATA%low\gksx9feji
- %LOCALAPPDATA%low\gksx9feji-shm
- %LOCALAPPDATA%low\mehizbf0a
- %LOCALAPPDATA%low\mehizbf0a-shm
- %LOCALAPPDATA%low\fraqbc8ws
- %LOCALAPPDATA%low\fraqbc8ws-shm
- %LOCALAPPDATA%low\5gmvdu0xn
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\ih7oe4ur9pw5zj0o.zip
- %LOCALAPPDATA%low\gxix4a2dre
- %LOCALAPPDATA%low\exuieaoeii
- %LOCALAPPDATA%low\3solbph71y
- %LOCALAPPDATA%low\x3cf3ednhm
- %LOCALAPPDATA%low\rqf69azbla
- %LOCALAPPDATA%low\rywtiizs2t
- %LOCALAPPDATA%low\1xvpfvjcrg
- %LOCALAPPDATA%low\bbsqwy6yhk
- %ALLUSERSPROFILE%\q2u1v8x1w0u1v8x1w0\igec10xurec9.ige
- %LOCALAPPDATA%low\wxxth3wdmxm.zip
- %LOCALAPPDATA%low\firefox_urls.txt
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-memory-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\accessiblemarshal.dll
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\accessiblehandler.dll
- %LOCALAPPDATA%low\machineinfo.txt
- %LOCALAPPDATA%low\pf2qc1gg7yh8hi1o\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%low\sqlite3.dll
- %ALLUSERSPROFILE%\q2u1v8x1w0u1v8x1w0\igec10xurec9.ige
- 'si####salabim.top':443
- 'sk#.#huua.ru':443
- '80.##.245.80':80
- 'a.###ganfor.ru':443
- '3x##.oradza.ru':443
- '17#.#0.40.83':81
- '18#.#93.88.150':80
- 'te##te.in':443
- '94.##3.94.198':3214
- 'xt#.#radza.ru':443
- http://10############6831-service1002012510022020.space/raccon.exe
- http://10############6831-service1002012510022020.space/reestr.exe
- http://10###########lder1002002131-service1002.space/
- http://10##########older33417-01242510022020.space/
- http://10############6831-service1002012510022020.space/
- http://80.##.245.80/log/
- http://94.###.94.198:3214/ via 94.##3.94.198
- http://17#.#0.40.83:81/ via 17#.#0.40.83
- DNS ASK 10###########lder1002002131-service1002.space
- DNS ASK 10###########lder1002002231-service1002.space
- DNS ASK 10##########older3100231-service1002.space
- DNS ASK 10###########lder1002002431-service1002.space
- DNS ASK 10###########lder1002002531-service1002.space
- DNS ASK 10##########older33417-01242510022020.space
- DNS ASK 10############5831-service1002012510022020.space
- DNS ASK 10############6831-service1002012510022020.space
- DNS ASK te##te.in
- DNS ASK si####salabim.top
- DNS ASK sk#.#huua.ru
- DNS ASK a.###ganfor.ru
- DNS ASK 3x##.oradza.ru
- DNS ASK xt#.#radza.ru
- '%TEMP%\5a5f.tmp.exe'
- '%TEMP%\6b60.tmp.exe'
- '%TEMP%\76b7.tmp.exe'
- '%TEMP%\7d0e.tmp.exe'
- '%TEMP%\b177.tmp.exe'
- '%TEMP%\db17.tmp.exe'
- '%TEMP%\e1eb.tmp.exe'
- '%TEMP%\f7cd.tmp.exe'
- '%TEMP%\1231.tmp.exe'
- '%TEMP%\23af.tmp.exe'
- '%APPDATA%\edgecp\microsoftedgecps.exe'
- '%APPDATA%\edgecp\microsoftedgecps.exe' ' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
- '%WINDIR%\syswow64\wbem\wmic.exe' /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'