Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52550 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52553 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52554 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52555 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52556 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52557 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52558 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52559 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52560 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52561 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52562 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52563 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52564 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52565 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52566 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52567 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52568 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52569 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52570 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52571 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52572 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52573 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52574 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52575 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52576 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52577 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52578 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52579 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52580 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52581 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52582 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52583 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52584 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52585 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52586 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52587 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52588 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52589 -> 45.83.207.67:6522 |
Source: Traffic |
Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:52590 -> 45.83.207.67:6522 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 45.83.207.67 |
Source: 00000008.00000002.4199453266.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown |
Source: 00000008.00000002.4199453266.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter |
Source: 00000008.00000002.4199453266.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group |
Source: 00000000.00000002.1947714950.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown |
Source: 00000000.00000002.1947714950.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter |
Source: 00000000.00000002.1947714950.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group |
Source: 00000008.00000002.4199453266.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04 |
Source: 00000008.00000002.4199453266.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net |
Source: 00000008.00000002.4199453266.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan |
Source: 00000000.00000002.1947714950.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04 |
Source: 00000000.00000002.1947714950.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net |
Source: 00000000.00000002.1947714950.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan |
Source: Botkiller.exe, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: Botkiller.exe, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: Botkiller.exe, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: Botkiller.exe, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.Botkiller.exe.4076df0.1.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.Botkiller.exe.4076df0.1.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.Botkiller.exe.4076df0.1.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.Botkiller.exe.4076df0.1.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.Botkiller.exe.4101e60.0.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.Botkiller.exe.4101e60.0.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.Botkiller.exe.4101e60.0.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.Botkiller.exe.4101e60.0.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: C:\Windows\SysWOW64\taskkill.exe |
WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "wscript.exe") |
Source: C:\Windows\SysWOW64\taskkill.exe |
WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cmd.exe") |
Source: C:\Windows\SysWOW64\taskkill.exe |
WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "wscript.exe") |
Source: C:\Windows\SysWOW64\taskkill.exe |
WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cmd.exe") |
Source: unknown |
Process created: C:\Users\user\Desktop\Botkiller.exe "C:\Users\user\Desktop\Botkiller.exe" |
|
Source: C:\Users\user\Desktop\Botkiller.exe |
Process created: C:\Windows\SysWOW64\taskkill.exe TASKKILL /F /IM wscript.exe |
|
Source: C:\Users\user\Desktop\Botkiller.exe |
Process created: C:\Windows\SysWOW64\taskkill.exe TASKKILL /F /IM cmd.exe |
|
Source: C:\Windows\SysWOW64\taskkill.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\SysWOW64\taskkill.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Users\user\Desktop\Botkiller.exe |
Process created: C:\Users\user\AppData\Roaming\Botkiller.exe "C:\Users\user\AppData\Roaming\Botkiller.exe" |
|
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process created: C:\Windows\SysWOW64\taskkill.exe TASKKILL /F /IM wscript.exe |
|
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process created: C:\Windows\SysWOW64\taskkill.exe TASKKILL /F /IM cmd.exe |
|
Source: C:\Windows\SysWOW64\taskkill.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\SysWOW64\taskkill.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Users\user\Desktop\Botkiller.exe |
Process created: C:\Windows\SysWOW64\taskkill.exe TASKKILL /F /IM wscript.exe |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process created: C:\Windows\SysWOW64\taskkill.exe TASKKILL /F /IM cmd.exe |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process created: C:\Users\user\AppData\Roaming\Botkiller.exe "C:\Users\user\AppData\Roaming\Botkiller.exe" |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process created: C:\Windows\SysWOW64\taskkill.exe TASKKILL /F /IM wscript.exe |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process created: C:\Windows\SysWOW64\taskkill.exe TASKKILL /F /IM cmd.exe |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: shfolder.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: framedynos.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: dbghelp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: winsta.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: framedynos.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: dbghelp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: winsta.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: shfolder.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: avicap32.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: msvfw32.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: framedynos.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: dbghelp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: winsta.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: framedynos.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: dbghelp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: winsta.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: Botkiller.exe, NhreygcXXMdvaRRkkA.cs |
High entropy of concatenated method names: 'caU8Ovu5r', 'GoH3ih4m3', 'btx4IqAmJ', 'oQ6OfxtT9', 'a7eDtX4dg', 'z6E2AIDLe', 'ENIwnoG4a', 'I0h7AoUoi', 'jcUfRFSND', 'oket1Tbqq' |
Source: Botkiller.exe, ncnGZNwPfpCJUeCmtj.cs |
High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'KGjVvHpp9v', 'mnbnJ69ChIq1J', 'A1mI1DgWD0', 'dhuIeARhF2', 'z9cIlnNWdG', 'VMmIF1vng3', 'SFrIB2JvG0', 'HmJICJSbbA', 'hgUIh7UZqZ' |
Source: Botkiller.exe, e8EidKugxv0oT3hZhb.cs |
High entropy of concatenated method names: 'Vrgdckc51m', 'U9Jdzoj1kS', 'UMWdjcoVRr', 'Y6MdvAyt9w', 'McgdalcYnR', 'acPdTBKJ6Z', 'MGjdRSRahY', 'ln0dgQ9rek', 'taAd5VfRjb', 'l5EduTZLXD' |
Source: 0.2.Botkiller.exe.4076df0.1.raw.unpack, NhreygcXXMdvaRRkkA.cs |
High entropy of concatenated method names: 'caU8Ovu5r', 'GoH3ih4m3', 'btx4IqAmJ', 'oQ6OfxtT9', 'a7eDtX4dg', 'z6E2AIDLe', 'ENIwnoG4a', 'I0h7AoUoi', 'jcUfRFSND', 'oket1Tbqq' |
Source: 0.2.Botkiller.exe.4076df0.1.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'KGjVvHpp9v', 'mnbnJ69ChIq1J', 'A1mI1DgWD0', 'dhuIeARhF2', 'z9cIlnNWdG', 'VMmIF1vng3', 'SFrIB2JvG0', 'HmJICJSbbA', 'hgUIh7UZqZ' |
Source: 0.2.Botkiller.exe.4076df0.1.raw.unpack, e8EidKugxv0oT3hZhb.cs |
High entropy of concatenated method names: 'Vrgdckc51m', 'U9Jdzoj1kS', 'UMWdjcoVRr', 'Y6MdvAyt9w', 'McgdalcYnR', 'acPdTBKJ6Z', 'MGjdRSRahY', 'ln0dgQ9rek', 'taAd5VfRjb', 'l5EduTZLXD' |
Source: 0.2.Botkiller.exe.4101e60.0.raw.unpack, NhreygcXXMdvaRRkkA.cs |
High entropy of concatenated method names: 'caU8Ovu5r', 'GoH3ih4m3', 'btx4IqAmJ', 'oQ6OfxtT9', 'a7eDtX4dg', 'z6E2AIDLe', 'ENIwnoG4a', 'I0h7AoUoi', 'jcUfRFSND', 'oket1Tbqq' |
Source: 0.2.Botkiller.exe.4101e60.0.raw.unpack, ncnGZNwPfpCJUeCmtj.cs |
High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'KGjVvHpp9v', 'mnbnJ69ChIq1J', 'A1mI1DgWD0', 'dhuIeARhF2', 'z9cIlnNWdG', 'VMmIF1vng3', 'SFrIB2JvG0', 'HmJICJSbbA', 'hgUIh7UZqZ' |
Source: 0.2.Botkiller.exe.4101e60.0.raw.unpack, e8EidKugxv0oT3hZhb.cs |
High entropy of concatenated method names: 'Vrgdckc51m', 'U9Jdzoj1kS', 'UMWdjcoVRr', 'Y6MdvAyt9w', 'McgdalcYnR', 'acPdTBKJ6Z', 'MGjdRSRahY', 'ln0dgQ9rek', 'taAd5VfRjb', 'l5EduTZLXD' |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\taskkill.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: Botkiller.exe, 00000008.00000002.4195922298.000000000091E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWx9g |
Source: Botkiller.exe, 00000000.00000002.1945840318.00000000010FE000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:` |
Source: Botkiller.exe, 00000008.00000002.4199453266.0000000002A01000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: VBoxServicevAntiProcess: VirtrualBox was detected! Reconnect after 5min"Sandboxie Control\AntiProcess: Sandboxie was detected and killed |
Source: Botkiller.exe, 00000008.00000002.4195922298.000000000091E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll |
Source: Botkiller.exe, 00000008.00000002.4199453266.0000000002A01000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: VGAuthServicelAntiProcess: VMware was detected! Reconnect after 5min |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: Botkiller.exe, 00000008.00000002.4196294982.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, Botkiller.exe, 00000008.00000002.4195922298.00000000009D5000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: r\MsMpeng.exe |
Source: Botkiller.exe, 00000008.00000002.4196294982.00000000009E4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: les%\Windows Defender\MsMpeng.exe |
Source: Botkiller.exe, 00000008.00000002.4196294982.00000000009E4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: rogramFiles%\Windows Defender\MsMpeng.exe |
Source: Botkiller.exe, 00000008.00000002.4197295194.0000000000AE5000.00000004.00000020.00020000.00000000.sdmp, Botkiller.exe, 00000008.00000002.4197495555.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, Botkiller.exe, 00000008.00000002.4195922298.000000000091E000.00000004.00000020.00020000.00000000.sdmp, Botkiller.exe, 00000008.00000002.4196294982.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, Botkiller.exe, 00000008.00000002.4195922298.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, Botkiller.exe, 00000008.00000002.4196294982.00000000009F4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe |
Source: Botkiller.exe, 00000008.00000002.4196294982.00000000009E4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: dows Defender\MsMpeng.exe |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |
Source: C:\Users\user\AppData\Roaming\Botkiller.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct |