Technical Information
Modifies file system
Creates the following files
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\nivo-slider[1].css
- D:\users\user\appdata\local\temp\tar7923.tmp
- D:\users\user\appdata\local\temp\cab7922.tmp
- D:\users\user\appdata\local\temp\tar7846.tmp
- D:\users\user\appdata\local\temp\cab7845.tmp
- D:\users\user\appdata\local\temp\tar7806.tmp
- D:\users\user\appdata\local\temp\cab7805.tmp
- D:\users\user\appdata\local\temp\tar772a.tmp
- D:\users\user\appdata\local\temp\tar76f9.tmp
- D:\users\user\appdata\local\temp\tar7954.tmp
- D:\users\user\appdata\local\temp\cab76f8.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\f66215ca2db238b2d1e7cbc8db493a33
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\f66215ca2db238b2d1e7cbc8db493a33
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\local\temp\cab7729.tmp
- D:\users\user\appdata\local\temp\tar6fa1.tmp
- D:\users\user\appdata\local\temp\cab7a2f.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_1e65fd33f74047223af4d58cbfd34bce
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\config\system
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\644b8874112055b5e195ecb0e8f243a4
- D:\users\user\appdata\local\temp\cab7953.tmp
- D:\windows\system32\winevt\logs\system.evtx
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\ntuser.dat
- D:\users\user\ntuser.dat.log1
- D:\windows\system32\winevt\logs\security.evtx
- D:\users\user\appdata\local\temp\tar7a30.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\style[1].css
- D:\users\user\appdata\local\temp\tar71f8.tmp
- D:\users\user\appdata\local\temp\cab71e7.tmp
- D:\users\user\appdata\local\temp\cab69ca.tmp
- D:\users\user\appdata\local\temp\cab6db4.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\style.min[1].css
- D:\users\user\appdata\local\temp\tar6cf8.tmp
- D:\users\user\appdata\local\temp\cab6cf7.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\style.min[2].css
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
- D:\windows\system32\config\software.log1
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\e0f5c59f9fa661f6f4c50b87fef3a15a
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\style.min[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\default[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\style.min[1].css
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\public[1].css
- D:\users\user\appdata\local\temp\tar69da.tmp
- D:\windows\system32\config\system.log1
- D:\users\user\appdata\local\temp\cab6df5.tmp
- D:\users\user\appdata\local\temp\cab6e45.tmp
- D:\windows\system32\config\software
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\bootstrap.min[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\all.min[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\styles[1].css
- D:\users\user\appdata\local\temp\tar70ae.tmp
- D:\users\user\appdata\local\temp\cab70ad.tmp
- D:\users\user\appdata\local\temp\tar706e.tmp
- D:\users\user\appdata\local\temp\tar6e05.tmp
- D:\users\user\appdata\local\temp\cab706d.tmp
- D:\users\user\appdata\local\temp\tar6db5.tmp
- D:\users\user\appdata\local\temp\cab6f90.tmp
- D:\users\user\appdata\local\temp\tar6f60.tmp
- D:\users\user\appdata\local\temp\cab6f5f.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\style.min[2].css
- D:\users\user\appdata\local\temp\tar6e46.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\style.min[1].css
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\classic-themes.min[1].css
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8
Deletes the following files
- D:\users\user\appdata\local\temp\cab69ca.tmp
- D:\users\user\appdata\local\temp\cab71e7.tmp
- D:\users\user\appdata\local\temp\tar71f8.tmp
- D:\users\user\appdata\local\temp\cab76f8.tmp
- D:\users\user\appdata\local\temp\tar76f9.tmp
- D:\users\user\appdata\local\temp\cab7729.tmp
- D:\users\user\appdata\local\temp\tar772a.tmp
- D:\users\user\appdata\local\temp\tar7806.tmp
- D:\users\user\appdata\local\temp\cab6e45.tmp
- D:\users\user\appdata\local\temp\cab7845.tmp
- D:\users\user\appdata\local\temp\tar7846.tmp
- D:\users\user\appdata\local\temp\cab7922.tmp
- D:\users\user\appdata\local\temp\tar7923.tmp
- D:\users\user\appdata\local\temp\cab7953.tmp
- D:\users\user\appdata\local\temp\tar7954.tmp
- D:\users\user\appdata\local\temp\tar70ae.tmp
- D:\users\user\appdata\local\temp\cab70ad.tmp
- D:\users\user\appdata\local\temp\tar706e.tmp
- D:\users\user\appdata\local\temp\cab706d.tmp
- D:\users\user\appdata\local\temp\tar6fa1.tmp
- D:\users\user\appdata\local\temp\cab6f90.tmp
- D:\users\user\appdata\local\temp\tar6f60.tmp
- D:\users\user\appdata\local\temp\cab6f5f.tmp
- D:\users\user\appdata\local\temp\tar6e46.tmp
- D:\users\user\appdata\local\temp\cab7805.tmp
- D:\users\user\appdata\local\temp\tar6e05.tmp
- D:\users\user\appdata\local\temp\cab6df5.tmp
- D:\users\user\appdata\local\temp\tar6db5.tmp
- D:\users\user\appdata\local\temp\cab6db4.tmp
- D:\users\user\appdata\local\temp\tar6cf8.tmp
- D:\users\user\appdata\local\temp\cab6cf7.tmp
- D:\users\user\appdata\local\temp\tar69da.tmp
- D:\users\user\appdata\local\temp\cab7a2f.tmp
- D:\users\user\appdata\local\temp\tar7a30.tmp
Network activity
Connects to
- 'qq#.qa':443
- 'di####.sanggau.go.id':80
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
TCP
HTTP GET requests
- http://di####.sanggau.go.id/wp-content/plugins/ml-slider/assets/metaslider/public.css?ve########
- http://di####.sanggau.go.id/wp-content/plugins/polls-widget/includes/gutenberg/style.css?ve#####
- http://di####.sanggau.go.id/wp-content/plugins/download-manager/assets/bootstrap/css/bootstrap.min.css?ve#####
- http://di####.sanggau.go.id/wp-content/plugins/download-manager/assets/fontawesome/css/all.min.css?ve#####
- http://di####.sanggau.go.id/wp-content/plugins/contact-form-7/includes/css/styles.css?ve#########
- http://di####.sanggau.go.id/wp-includes/css/classic-themes.min.css?ve#####
- http://di####.sanggau.go.id/wp-content/plugins/captainform/admin/gutenberg/blocks.style.build.css?ve#####
- http://x1.#.lencr.org/
- http://di####.sanggau.go.id/wp-includes/css/dist/editor/style.min.css?ve#####
- http://di####.sanggau.go.id/wp-includes/css/dist/nux/style.min.css?ve#####
- http://di####.sanggau.go.id/wp-includes/css/dist/block-editor/style.min.css?ve#####
- http://di####.sanggau.go.id/wp-includes/css/dist/components/style.min.css?ve#####
- http://di####.sanggau.go.id/wp-includes/css/dist/block-library/style.min.css?ve#####
- http://di####.sanggau.go.id/wp-content/plugins/ml-slider/assets/sliders/nivoslider/themes/default/default.css?ve########
- http://di####.sanggau.go.id/wp-content/plugins/ml-slider/assets/sliders/nivoslider/nivo-slider.css?ve########
- http://di####.sanggau.go.id/wp-includes/css/dist/reusable-blocks/style.min.css?ve#####
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQ8Kx2pDoS9TgPduQQho87QTg%3D%3D
Other
- 'qq#.qa':443
UDP
- DNS ASK qq#.qa
- DNS ASK di####.sanggau.go.id
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
