Resubmissions
15/08/2026, 21:19
260815-z592tshg5712/05/2026, 09:30
260512-lghqsah14t12/05/2026, 09:29
260512-lf4a4ad17m11/05/2026, 13:07
260511-qcln4aaw4z09/05/2026, 21:41
260509-1j69gsdv7w1009/05/2026, 21:41
260509-1jyx4sdv7s19/04/2026, 22:54
260419-2vxd4aby7r11/04/2026, 06:46
260411-hjw5eaas2p25/03/2026, 09:51
260325-lvksascz5w1022/02/2026, 15:16
260222-snsb5ab16e10Analysis
- max time kernel
10s - max time network
168s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
27/06/2025, 17:28
General
- Target 31.exe
- Size 12.5MB
- Sample250627-v1z9lsstdw
- SHA256 7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
Malware Config
Extracted
-
formbook
-
4.0
-
w9z
-
crazzysex.com
-
hanferd.com
-
gteesrd.com
-
bayfrontbabyplace.com
-
jicuiquan.net
-
relationshiplink.net
-
ohchacyberphoto.com
-
kauegimenes.com
-
powerful-seldom.com
-
ketotoken.com
-
make-money-online-success.com
-
redgoldcollection.com
-
hannan-football.com
-
hamptondc.com
-
vllii.com
-
aa8520.com
-
platform35markethall.com
-
larozeimmo.com
-
oligopoly.net
-
llhak.info
Extracted
-
gozi
-
build
300869
-
exe_type
loader
Extracted
-
gozi
-
86920224
-
https://sibelikinciel.xyz
-
build
300869
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
Extracted
-
formbook
-
4.1
-
i0qi
-
mytakeawaybox.com
-
goutaihuo.com
-
kuzey.site
-
uppertenpiercings.amsterdam
-
honeygrandpa.com
-
jenniferabramslaw.com
-
ncarian.com
-
heavilymeditatedhouston.com
-
gsbjyzx.com
-
akisanblog.com
-
taoyuanreed.com
-
jasperrvservices.com
-
yabbanet.com
-
myhealthfuldiet.com
-
flipdigitalcoins.com
-
toes.photos
-
shoottillyoumiss.com
-
maserental.com
-
smarteacher.net
-
hamdimagdeco.com
Extracted
-
qakbot
-
324.141
-
spx129
-
1590734339
-
94.10.81.239:443
-
94.52.160.116:443
-
67.0.74.119:443
-
175.137.136.79:443
-
73.232.165.200:995
-
79.119.67.149:443
-
62.38.111.70:2222
-
108.58.9.238:993
-
216.110.249.252:2222
-
67.209.195.198:3389
-
84.247.55.190:443
-
96.37.137.42:443
-
94.176.220.76:2222
-
173.245.152.231:443
-
96.227.122.123:443
-
188.192.75.8:995
-
24.229.245.124:995
-
71.163.225.75:443
-
75.71.77.59:443
-
104.36.135.227:443
Extracted
-
formbook
-
4.1
-
app
-
niresandcard.com
-
bonusscommesseonline.com
-
mezhyhirya.com
-
paklfz.com
-
bespokewomensuits.com
-
smarteralarm.info
-
munespansiyon.com
-
pmtradehouse.com
-
hotmobile-uk.com
-
ntdao.com
-
zohariaz.com
-
www145123.com
-
oceanstateofstyle.com
-
palermofelicissima.info
-
yourkinas.com
-
pthwheel.net
-
vfmagent.com
-
xn--3v0bw66b.com
-
comsystematrisk.win
-
on9.party
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Dharma family
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Gozi family
- Qakbot family
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- AgentTesla payload 6 IoCs
- CryptOne packer 2 IoCs
Detects CryptOne packer defined in NCC blogpost.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Formbook payload 5 IoCs
- ReZer0 packer 3 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Drops startup file 1 IoCs
- Executes dropped EXE 31 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 3 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies registry class 1 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31.exe"C:\Users\Admin\AppData\Local\Temp\31.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7995.tmp\7996.tmp\7997.bat C:\Users\Admin\AppData\Local\Temp\31.exe"3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"4⤵
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\4.exeC:\Users\Admin\AppData\Roaming\4.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 2765⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\5.exeC:\Users\Admin\AppData\Roaming\5.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\6.exeC:\Users\Admin\AppData\Roaming\6.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\7.exeC:\Users\Admin\AppData\Roaming\7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\7.exeC:\Users\Admin\AppData\Roaming\7.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\8.exeC:\Users\Admin\AppData\Roaming\8.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Roaming\feeed.exe"C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\9.exeC:\Users\Admin\AppData\Roaming\9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp625.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\10.exeC:\Users\Admin\AppData\Roaming\10.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 2485⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\11.exeC:\Users\Admin\AppData\Roaming\11.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD69.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\11.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\14.exeC:\Users\Admin\AppData\Roaming\14.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 2485⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\15.exeC:\Users\Admin\AppData\Roaming\15.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\15.exeC:\Users\Admin\AppData\Roaming\15.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\16.exeC:\Users\Admin\AppData\Roaming\16.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\17.exeC:\Users\Admin\AppData\Roaming\17.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 2525⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\18.exeC:\Users\Admin\AppData\Roaming\18.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\21.exeC:\Users\Admin\AppData\Roaming\21.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\21.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\22.exeC:\Users\Admin\AppData\Roaming\22.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\23.exeC:\Users\Admin\AppData\Roaming\23.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\24.exeC:\Users\Admin\AppData\Roaming\24.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\24.exe"{path}"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\25.exeC:\Users\Admin\AppData\Roaming\25.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeC:\Users\Admin\AppData\Roaming\25.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\26.exeC:\Users\Admin\AppData\Roaming\26.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5FDE.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe /C5⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exeC:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exe5⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exeC:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exe /C6⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exe" /W7⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn {B3043089-3AC1-4F68-848E-08B0EAECC2C3} /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exe\"" /sc HOURLY /mo 5 /F7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mpljzitmh /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I mpljzitmh" /SC ONCE /Z /ST 17:32 /ET 17:445⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\28.exeC:\Users\Admin\AppData\Roaming\28.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\29.exeC:\Users\Admin\AppData\Roaming\29.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 2685⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\30.exeC:\Users\Admin\AppData\Roaming\30.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"5⤵
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
- Modifies registry key
-
-
-
-
C:\Users\Admin\AppData\Roaming\31.exeC:\Users\Admin\AppData\Roaming\31.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\2.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\System32\16.exe2⤵
-
C:\Windows\System32\16.exeC:\Windows\System32\16.exe3⤵
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\18.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\pcalua.exe -a C:\Users\Admin\AppData\Roaming\feeed.exe2⤵
-
C:\Windows\system32\pcalua.exeC:\Windows\system32\pcalua.exe -a C:\Users\Admin\AppData\Roaming\feeed.exe3⤵
-
C:\Users\Admin\AppData\Roaming\feeed.exe"C:\Users\Admin\AppData\Roaming\feeed.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.vbs2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Dibromob\PRECONCE.vbs2⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\11.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exeC:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exeC:\Users\Admin\AppData\Roaming\Microsoft\Rsstcyztxn\jqqco.exe /C4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mshta.exe "C:\Users\Admin\AppData\Roaming\Info.hta"2⤵
-
C:\Windows\system32\mshta.exemshta.exe "C:\Users\Admin\AppData\Roaming\Info.hta"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mshta.exe "C:\Windows\System32\Info.hta"2⤵
-
C:\Windows\system32\mshta.exemshta.exe "C:\Windows\System32\Info.hta"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Program Files (x86)\Ihfidufwh\mssffl.exe2⤵
-
-
C:\Program Files (x86)\Ihfidufwh\mssffl.exe"C:\Program Files (x86)\Ihfidufwh\mssffl.exe"2⤵
-
C:\Program Files (x86)\Ihfidufwh\mssffl.exe"C:\Program Files (x86)\Ihfidufwh\mssffl.exe"3⤵
-
-
-
C:\Program Files (x86)\Wyrkdmbmx\cnwtl8cp28ftb.exe"C:\Program Files (x86)\Wyrkdmbmx\cnwtl8cp28ftb.exe"2⤵
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\CpSnJ\CpSnJ.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\CpSnJ\CpSnJ.exeC:\Users\Admin\AppData\Local\Temp\CpSnJ\CpSnJ.exe3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3036 -ip 30361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5220 -ip 52201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5516 -ip 55161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1116 -ip 11161⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1900 -ip 19001⤵
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7216 CREDAT:17410 /prefetch:22⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
AppvIsvSubsystems64.dll.id-7BC7723E.[[email protected]].BOMBO
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
7997.bat
Kno7BCD.tmp
1.jar
10.exe
11.exe
12.exe
13.exe
14.exe
15.exe
16.exe
17.exe
18.exe
19.exe
2.exe
20.exe
21.exe
22.exe
23.exe
24.exe
25.exe
26.exe
27.exe
28.exe
29.exe
3.exe
30.exe
31.exe
4.exe
5.exe
6.exe
7.exe
8.exe
9.exe
index.html
license
license
.travis.yml
GOVERNANCE.md
LICENSE
README.md
2015-01-30.md
duplex-browser.js
duplex.js
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_writable.js
BufferList.js
destroy.js
stream-browser.js
stream.js
passthrough.js
readable-browser.js
readable.js
transform.js
writable-browser.js
writable.js
.travis.yml
LICENSE
README.md
string_decoder.js
LICENSE
.npmignore
Makefile
LICENSE
PULL_REQUEST_TEMPLATE
.travis.yml
appveyor.yml
LICENSE.md
LICENSE
LICENSE
LICENSE
LICENSE
README.md
LICENSE
.editorconfig
LICENSE
LICENSE
index.js
LICENSE
LICENSE
LICENSE
.travis.yml
LICENSE
LICENSE
.editorconfig
README.md
index.js
README.md
index.coffee
index.js
LICENSE
LICENSE
.npmignore
.npmignore
tag.js
.travis.yml
LICENSE.APACHE2
LICENSE.MIT
LICENSE
index.d.ts
LICENSE.txt
LICENSE
LICENSE
index.js
readme.md
node-gyp
node-gyp.cmd
npm
npm.cmd
npx
npx.cmd
network-icon-f659855f70bb0e12addd96250807c241.svg
is-windows.js
History.md
README.md
index.js
LICENSE
LICENSE
defer.js
en.js
LICENSE
index.js
readme.md
index.js
readme.md
License
LICENSE
license
LICENSE
README.md
license.md
LICENSE
.travis.yml
.npmignore
.travis.yml
es6.js
isPrimitive.js
es6-promise.auto.js
es6-promise.auto.map
es6-promise.map
stdio.js
buffer-stream.js
index.js
readme.md
LICENSE
LICENSE
.travis.yml
LICENSE
LICENSE.md
LICENSE
LICENSE
.npmignore
LICENSE
.jscs.json
.travis.yml
.jscs.json
component.json
nb.json
.travis.yml
parse.js
readme.markdown
prettify.css
prettify.js
sort-arrow-sprite.png
README.md
index.js
License
equation.gif
dns.js
stop.js
index.js
license
LICENSE
LICENSE
CHANGELOG.md
LICENSE
install_tools.bat
node_etw_provider.man
.licensee.json
.mailmap
.npmignore
.travis.yml
AUTHORS
CHANGELOG.md
CONTRIBUTING.md
npm-cli.js
npx-cli.js
CHANGELOG-1.md
CHANGELOG-2.md
CHANGELOG-3.md
CHANGELOG-4.md
CHANGELOG-5.md
configure
LICENSE
npm-access.md
npm-adduser.md
npm-audit.md
npm-bin.md
npm-bugs.md
npm-build.md
npm-bundle.md
npm-cache.md
npm-ci.md
npm-completion.md
npm-config.md
npm-dedupe.md
npm-deprecate.md
npm-dist-tag.md
npm-docs.md
npm-doctor.md
npm-edit.md
npm-explore.md
npm-fund.md
npm-help-search.md
npm-help.md
npm-hook.md
npm-init.md
npm-install-ci-test.md
npm-install-test.md
npm-install.md
npm-link.md
npm-logout.md
npm-ls.md
npm-org.md
npm-outdated.md
npm-owner.md
npm-pack.md
npm-ping.md
npm-prefix.md
npm-profile.md
npm-prune.md
npm-publish.md
npm-rebuild.md
npm-repo.md
npm-restart.md
npm-root.md
npm-run-script.md
npm-search.md
npm-shrinkwrap.md
npm-star.md
npm-stars.md
npm-start.md
npm-stop.md
npm-team.md
npm-test.md
npm-token.md
npm-uninstall.md
npm-unpublish.md
npm-update.md
npm-version.md
npm-view.md
npm-whoami.md
npm.md
folders.md
install.md
npmrc.md
package-json.md
package-lock-json.md
package-locks.md
shrinkwrap-json.md
config.md
developers.md
disputes.md
orgs.md
registry.md
removal.md
scope.md
scripts.md
semver.md
gatsby-browser.js
gatsby-config.js
gatsby-node.js
gatsby-ssr.js
package-lock.json
package.json
QldKNThLqRwH-OJ1UHjlKGlZ5q4.woff
QldKNThLqRwH-OJ1UHjlKGlZ5qg.woff2
QldXNThLqRwH-OJ1UHjlKGHiw71p5_o.woff
QldXNThLqRwH-OJ1UHjlKGHiw71p5_w.woff2
pxiByp8kv8JHgFVrLDz8Z1xlEw.woff
pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
pxiByp8kv8JHgFVrLGT9Z1xlEw.woff
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
pxiEyp8kv8JHgFVrJJfecg.woff2
pxiEyp8kv8JHgFVrJJfedA.woff
icon-144x144.png
icon-192x192.png
icon-256x256.png
icon-384x384.png
icon-48x48.png
icon-512x512.png
icon-72x72.png
icon-96x96.png
index.html
2215187023.json
2417117884.json
styles.e93b5499b63484750fba.css
Accordion.js
Button.js
DocLinks.js
FoundTypo.js
MobileSidebar.js
Sidebar.js
DarkBlock.js
FeatureCard.js
Features.js
Footer.js
Terminal.js
Windows.js
cubes.js
hero.js
layout.js
links.js
navbar.js
scripts.js
seo.js
background-boxes.svg
background-cubes.svg
background-rectangles.svg
bracket.svg
cli-logo.svg
down-carrot.svg
hamburger-close.svg
hamburger.svg
manager-icon.svg
npm-icon.png
orange-cube.svg
pink-gradient-cube.svg
purple-cube.svg
purple-gradient-cube.svg
red-cube.svg
right-shadow-box.svg
terminal-icon.svg
test-icon.svg
up-carrot.svg
x.svg
main.css
404.js
index.js
Page.js
theme.js
access.js
adduser.js
audit.js
legacy.js
oauth.js
saml.js
sso.js
bin.js
bugs.js
build.js
cache.js
ci.js
completion.js
config.js
bin-links.js
clear-credentials-by-uri.js
cmd-list.js
core.js
defaults.js
figgy-config.js
gentle-fs.js
get-credentials-by-uri.js
lifecycle.js
load-cafile.js
load-prefix.js
nerf-dart.js
set-credentials-by-uri.js
set-user.js
dedupe.js
deprecate.js
dist-tag.js
docs.js
doctor.js
check-files-permission.js
check-ping.js
get-git-path.js
link.js
deep-sort-object.js
nodevars.bat
memory/872-41187-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/940-120-0x0000000005830000-0x0000000005DD6000-memory.dmp
memory/940-113-0x0000000000810000-0x00000000008BC000-memory.dmp
memory/940-132-0x0000000005710000-0x0000000005754000-memory.dmp
memory/940-133-0x0000000005580000-0x0000000005588000-memory.dmp
memory/940-131-0x0000000005460000-0x0000000005468000-memory.dmp
memory/940-121-0x0000000002B40000-0x0000000002B48000-memory.dmp
memory/940-117-0x0000000002B30000-0x0000000002B44000-memory.dmp
memory/1108-6559-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/1108-3864-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/1108-10223-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/1140-5773-0x0000000000400000-0x000000000044E000-memory.dmp
memory/1916-3863-0x0000000004F20000-0x00000000050BA000-memory.dmp
memory/1916-4828-0x0000000005270000-0x0000000005276000-memory.dmp
memory/1916-5347-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/1916-587-0x00000000071A0000-0x00000000071A6000-memory.dmp
memory/1916-242-0x00000000002D0000-0x0000000000454000-memory.dmp
memory/2036-834-0x00000000053F0000-0x0000000005430000-memory.dmp
memory/2036-1401-0x00000000055B0000-0x00000000055DD000-memory.dmp
memory/2036-588-0x00000000053A0000-0x00000000053F2000-memory.dmp
memory/2036-247-0x0000000000A00000-0x0000000000A6E000-memory.dmp
memory/2204-248-0x0000000000560000-0x00000000005F8000-memory.dmp
memory/2204-6852-0x0000000006560000-0x00000000065B6000-memory.dmp
memory/2204-5110-0x0000000004ED0000-0x0000000004F32000-memory.dmp
memory/2220-16059-0x0000000000400000-0x000000000055D000-memory.dmp
memory/2220-6578-0x0000000000400000-0x000000000055D000-memory.dmp
memory/2720-35218-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/2720-34567-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/2808-119-0x0000000005620000-0x00000000056B2000-memory.dmp
memory/2808-122-0x00000000054D0000-0x00000000054DA000-memory.dmp
memory/2808-142-0x0000000005900000-0x0000000005908000-memory.dmp
memory/2808-118-0x0000000000BB0000-0x0000000000C6E000-memory.dmp
memory/2808-150-0x0000000008080000-0x000000000811C000-memory.dmp
memory/2808-145-0x0000000005B70000-0x0000000005BC8000-memory.dmp
memory/3188-151-0x0000000000170000-0x00000000002BE000-memory.dmp
memory/3188-152-0x0000000000170000-0x00000000002BE000-memory.dmp
memory/3284-39084-0x0000000002530000-0x0000000002531000-memory.dmp
memory/3284-5360-0x0000000002500000-0x0000000002501000-memory.dmp
memory/3284-28430-0x00000000069A0000-0x0000000006AA1000-memory.dmp
memory/3284-26995-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/3284-197-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/3284-6580-0x0000000002540000-0x0000000002541000-memory.dmp
memory/3284-23462-0x00000000069A0000-0x0000000006AA1000-memory.dmp
memory/3284-21442-0x0000000002780000-0x0000000002843000-memory.dmp
memory/3284-41938-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/3284-34480-0x0000000003CE0000-0x0000000003CE1000-memory.dmp
memory/3284-34478-0x0000000003CD0000-0x0000000003CD1000-memory.dmp
memory/3284-41433-0x00000000069A0000-0x0000000006AA1000-memory.dmp
memory/3284-41936-0x00000000069A0000-0x0000000006AA1000-memory.dmp
memory/3284-28788-0x0000000006F40000-0x000000000709A000-memory.dmp
memory/3284-6577-0x0000000002520000-0x0000000002521000-memory.dmp
memory/3504-6044-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3772-14195-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3772-25597-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3904-0-0x0000000000416000-0x0000000000417000-memory.dmp
memory/4772-35229-0x0000000000400000-0x0000000000452000-memory.dmp
memory/4844-20922-0x0000000006740000-0x0000000006762000-memory.dmp
memory/4956-123-0x00000281D7A20000-0x00000281D7A21000-memory.dmp
memory/4956-26946-0x00000281D7A20000-0x00000281D7A21000-memory.dmp
memory/4956-112-0x00000281D7A20000-0x00000281D7A21000-memory.dmp
memory/4956-26770-0x00000281D7A20000-0x00000281D7A21000-memory.dmp
memory/4956-6553-0x00000281D7A20000-0x00000281D7A21000-memory.dmp
memory/4956-35231-0x00000281D7A20000-0x00000281D7A21000-memory.dmp
memory/4956-6649-0x00000281D7A20000-0x00000281D7A21000-memory.dmp
memory/4964-1831-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4964-90-0x00000000020A0000-0x00000000020B0000-memory.dmp
memory/5060-86-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/5300-148-0x0000000000400000-0x000000000042D000-memory.dmp
memory/5300-81-0x0000000000400000-0x000000000042D000-memory.dmp
memory/5788-238-0x00000000004D0000-0x000000000053A000-memory.dmp
memory/5788-5308-0x0000000007B90000-0x0000000007BE8000-memory.dmp
memory/6240-9911-0x0000000005200000-0x0000000005218000-memory.dmp
memory/6240-6562-0x0000000000400000-0x0000000000452000-memory.dmp
memory/6652-35217-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/6972-3213-0x0000000000010000-0x000000000006B000-memory.dmp
memory/7008-42389-0x0000000000400000-0x000000000042D000-memory.dmp
memory/7040-25518-0x0000000000400000-0x0000000000450000-memory.dmp
memory/7292-25244-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-29518-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-35579-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-26123-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-35234-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-39105-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-35232-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-25986-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-25987-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7292-35233-0x0000000001230000-0x0000000001262000-memory.dmp
memory/7348-22414-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/7348-18951-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/7936-28415-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/8000-25300-0x0000000000400000-0x0000000000452000-memory.dmp
memory/9640-22260-0x00000000005A0000-0x00000000005AE000-memory.dmp
memory/9640-22254-0x00000000005A0000-0x00000000005AE000-memory.dmp
memory/10004-20603-0x0000000000400000-0x000000000042D000-memory.dmp
memory/11132-43011-0x0000000000110000-0x0000000000150000-memory.dmp
memory/11132-43012-0x00000000024D0000-0x00000000024EA000-memory.dmp
memory/11132-43013-0x0000000004C30000-0x0000000004D8A000-memory.dmp
memory/11472-19933-0x0000000000400000-0x0000000000452000-memory.dmp