Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.8.158.104 |
Source: bf.exe, 00000000.00000003.612015496.00000000006D2000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://45.8.158.104/uploaded/MpZpEfGoUvu/8hUMFuBMM1NnXA/6MZyif_2BG2HgaMoqVeei/YUDzzwQcxrHdHNoS/EXZmG |
Source: bf.exe, 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, bf.exe, 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, control.exe, 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://constitution.org/usdeclar.txt |
Source: bf.exe, 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, bf.exe, 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, control.exe, 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://constitution.org/usdeclar.txtC: |
Source: powershell.exe, 00000005.00000003.638688227.000001C32A171000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://crl.microsofU |
Source: bf.exe, 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, bf.exe, 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, control.exe, 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, control.exe, 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://https://file://USER.ID%lu.exe/upd |
Source: explorer.exe, 0000000B.00000000.717723054.000000000F014000.00000004.00000001.00020000.00000000.sdmp | String found in binary or memory: http://trackingg-protectioon.cdn1.mozilla.net/uploaded/OpQxWz98QKMWv_2/FDwCe9CiLqhz94zXhO/jzUmpRbDp/ |
Source: explorer.exe, 0000000B.00000000.699574757.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.723471805.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.667027858.000000000091F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://www.autoitscript.com/autoit3/J |
Source: Yara match | File source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.615812905.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000000.714710213.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 4604, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 4784, type: MEMORYSTR |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000C.00000000.681883913.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.613944350.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.680871269.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.684080193.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614315107.0000000001329000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.615812905.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000000.714710213.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 4604, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 4784, type: MEMORYSTR |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000C.00000000.681883913.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.613944350.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.680871269.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.684080193.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614315107.0000000001329000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.615665561.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.615665561.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 0000000B.00000000.714710213.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown |
Source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: Process Memory Space: powershell.exe PID: 4604, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: Process Memory Space: control.exe PID: 4784, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown |
Source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.615665561.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.615665561.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 0000000B.00000000.714710213.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23 |
Source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: Process Memory Space: powershell.exe PID: 4604, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: Process Memory Space: control.exe PID: 4784, type: MEMORYSTR | Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004963E0 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0049D6F0 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A8868 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0048887C |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0049887C |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A9010 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0048A89C |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0048B14C |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0049594C |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0049996C |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00482178 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00495108 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004929EC |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0049F26C |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0049DA04 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00494A1C |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0048E2D4 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0048D2F4 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0048C340 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0049FBE8 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004863F0 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004833F4 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00488BB0 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004983B4 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00490C28 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00497484 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A7498 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A6D20 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A45A0 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A1E44 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A466A |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00481E64 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A8604 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00499E18 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00492EC4 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0048B6DC |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004926E8 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_0049AEF8 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004A4694 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004846B0 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00498F68 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_004897E0 |
Source: C:\Windows\System32\control.exe | Code function: 12_2_00493FF8 |
Source: Yara match | File source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.615812905.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000000.714710213.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 4604, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 4784, type: MEMORYSTR |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000C.00000000.681883913.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.613944350.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.680871269.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.684080193.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614315107.0000000001329000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\bf.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\bf.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process information set: NOOPENFILEERRORBOX |
Source: Yara match | File source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.615812905.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000000.714710213.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 4604, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 4784, type: MEMORYSTR |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000C.00000000.681883913.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.613944350.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.680871269.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.684080193.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614315107.0000000001329000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567245222.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567067174.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684854059.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.740959208.00000000125FC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567273326.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567261727.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000003.684949617.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567123071.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.615812905.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614908224.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.738730438.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567222358.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567018917.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.668851717.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000002.724699237.00000262EE44C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.567191863.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000000.714710213.000000000DCBC000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.686932943.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000003.665421509.000001C32A8EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.612073912.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: bf.exe PID: 1364, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: powershell.exe PID: 4604, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: control.exe PID: 4784, type: MEMORYSTR |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.12aa4a0.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.13294a0.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.bf.exe.1355940.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000C.00000000.681883913.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.613944350.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.680871269.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000C.00000000.684080193.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.614315107.0000000001329000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |