Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then xor edx, edx |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then xor edx, edx |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then xor edx, edx |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor edx, edx |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor edx, edx |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor edx, edx |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor edx, edx |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor edx, edx |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then xor eax, eax |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 4x nop then mov eax, dword ptr [ebx] |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.472146872.00000000026A7000.00000004.00000001.sdmp, Uclldrv.exe, 00000012.00000002.473298428.0000000002797000.00000004.00000001.sdmp | String found in binary or memory: http://127.0.0.1:HTTP/1.1 |
Source: Uclldrv.exe, 00000012.00000002.473298428.0000000002797000.00000004.00000001.sdmp | String found in binary or memory: http://DynDns.comDynDNS |
Source: Uclldrv.exe, 0000000D.00000002.363645356.0000000003FF0000.00000004.00000001.sdmp, Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.co |
Source: Uclldrv.exe, 0000000D.00000002.363645356.0000000003FF0000.00000004.00000001.sdmp, Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-adm0 |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/t |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twent |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-se |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-sevent8 |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/ |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/7009$ |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/70099875 |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/70099875453/ |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/70099875453/css/ |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/70099875453/css/Ucll |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/70099875453/css/Ucll0848 |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/70099875453/css/Ucll08488374H |
Source: Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: http://airseaalliance.com/wp-admin/twenty-seventeen/70099875453/css/Ucll08488374ODU8 |
Source: Uclldrv.exe, 00000012.00000002.473298428.0000000002797000.00000004.00000001.sdmp | String found in binary or memory: http://hHeaxI.com |
Source: Uclldrv.exe, 00000012.00000002.473298428.0000000002797000.00000004.00000001.sdmp | String found in binary or memory: https://api.ipify.orgGETMozilla/5.0 |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.472146872.00000000026A7000.00000004.00000001.sdmp, Uclldrv.exe, 00000012.00000002.473298428.0000000002797000.00000004.00000001.sdmp | String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x |
Source: Uclldrv.exe, 0000000D.00000002.363645356.0000000003FF0000.00000004.00000001.sdmp, Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: https://discord.com/ |
Source: Uclldrv.exe, 0000000D.00000002.363645356.0000000003FF0000.00000004.00000001.sdmp, Uclldrv.exe, 00000010.00000002.373966981.0000000004020000.00000004.00000001.sdmp | String found in binary or memory: https://discord.com/J |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.472146872.00000000026A7000.00000004.00000001.sdmp, Uclldrv.exe, 00000012.00000002.473298428.0000000002797000.00000004.00000001.sdmp | String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ECBAC4 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ECBA44 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ECBA42 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC9170 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC9931 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED6E58 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED6E58 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EBFEC0 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EBFEC0 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00408C60 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_0040DC11 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00407C3F |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00418CCC |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00406CA0 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_004028B0 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_0041A4BE |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00418244 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00401650 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00402F20 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_004193C4 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00418788 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00402F89 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00402B90 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_004073A0 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_022A0C60 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_022A0C50 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_04A80006 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_04A80040 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_05A82D58 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_05A84C70 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_05A82140 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_05A82488 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F1BAC4 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F1BA42 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F1BA44 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F19170 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F19931 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F26E58 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F26E58 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F0FEC0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 13_3_03F0FEC0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 16_3_03F4BAC4 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 16_3_03F4BA44 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 16_3_03F4BA42 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 16_3_03F49931 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00408C60 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_0040DC11 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00407C3F |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00418CCC |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00406CA0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_004028B0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_0041A4BE |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00418244 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00401650 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00402F20 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_004193C4 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00418788 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00402F89 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00402B90 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_004073A0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_02340C60 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_02340C50 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_04F90040 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_04F9003A |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_04F99283 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_05A82FA0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_05A82388 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_05A84EB0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_05A826D0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00408C60 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_0040DC11 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00407C3F |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00418CCC |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00406CA0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_004028B0 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_0041A4BE |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00418244 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00401650 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00402F20 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_004193C4 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00418788 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00402F89 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_00402B90 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_1_004073A0 |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.477801759.0000000005630000.00000002.00000001.sdmp | Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.468175139.00000000023E0000.00000004.00000001.sdmp | Binary or memory string: OriginalFilenameygwxuBNDsCnleMFrPILFrkECdmuYRRQwMZPAraQ.exe4 vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.468175139.00000000023E0000.00000004.00000001.sdmp | Binary or memory string: OriginalFilename_.dll4 vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.468624139.0000000002490000.00000002.00000001.sdmp | Binary or memory string: OriginalFilenamenlsbres.dllj% vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.477770135.0000000005620000.00000002.00000001.sdmp | Binary or memory string: OriginalFilenamewbemdisp.tlbj% vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.468661954.00000000024A0000.00000002.00000001.sdmp | Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.469808808.000000000262A000.00000004.00000001.sdmp | Binary or memory string: OriginalFilenameclrjit.dllT vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.469808808.000000000262A000.00000004.00000001.sdmp | Binary or memory string: OriginalFilename vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: USD67,884.08_Payment_Advise_9083008849.exe, 00000005.00000002.469808808.000000000262A000.00000004.00000001.sdmp | Binary or memory string: m,\\StringFileInfo\\040904B0\\OriginalFilename vs USD67,884.08_Payment_Advise_9083008849.exe |
Source: 0000000D.00000002.362836092.0000000002AC7000.00000020.00000001.sdmp, type: MEMORY | Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019 |
Source: 0000000D.00000002.362836092.0000000002AC7000.00000020.00000001.sdmp, type: MEMORY | Matched rule: Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/ItsReallyNick/status/1176229087196696577, score = 27.09.2019 |
Source: C:\Users\user\AppData\Local\llcU.url, type: DROPPED | Matched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019 |
Source: C:\Users\user\AppData\Local\llcU.url, type: DROPPED | Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019 |
Source: C:\Users\user\AppData\Local\llcU.url, type: DROPPED | Matched rule: Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/ItsReallyNick/status/1176229087196696577, score = 27.09.2019 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED2BC8 push 0040547Ch; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED63C4 push 00408CBBh; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED2BC6 push 0040547Ch; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED63C2 push 00408CBBh; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED6B9C push ecx; mov dword ptr [esp], eax |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED6244 push 00408C48h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC4A28 push 00404FE9h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED2A28 push 004052DCh; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED29EE push 004052A4h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED29F0 push 004052A4h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ECA1D8 push 14004056h; retn 0040h |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ECC1AC push 0040A2B5h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC5198 push 00405734h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ECC124 push 0040A1F2h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ECC122 push 0040A1F2h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC87CC push 00408D60h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC87C4 push 00408D60h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC87C2 push 00408D60h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC878C push 00408D20h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC8784 push 00408D20h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC8782 push 00408D20h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC5F60 push ecx; mov dword ptr [esp], eax |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC4F18 push 00405734h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ED2710 push 00404FE9h; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC4EE8 push 0040547Ch; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC4EE0 push 0040547Ch; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC86DC push 00408CBBh; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC4EDE push 0040547Ch; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC86DA push 00408CBBh; ret |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03ECC6A0 push 14004056h; retn 0040h |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 0_3_03EC8EB4 push ecx; mov dword ptr [esp], eax |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -2767011611056431s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 6140 | Thread sleep count: 32 > 30 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 6140 | Thread sleep count: 661 > 30 |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -60000s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -59500s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -59312s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -58906s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -58406s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -58218s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -57812s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -57312s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -56906s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -56718s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -56218s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -55812s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -55594s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -54906s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -54718s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -53812s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -53594s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -53406s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -53218s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -52718s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -52312s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -51406s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -51218s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -51000s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -50094s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -49718s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -49218s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -49000s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -48812s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -48594s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -47500s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -46812s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -46594s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe TID: 1124 | Thread sleep time: -46218s >= -30000s |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe TID: 2408 | Thread sleep time: -2767011611056431s >= -30000s |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe TID: 2416 | Thread sleep count: 471 > 30 |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe TID: 2408 | Thread sleep time: -30000s >= -30000s |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Code function: 5_2_004123F1 SetUnhandledExceptionFilter, |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Code function: 18_2_004123F1 SetUnhandledExceptionFilter, |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Source: C:\Users\user\Desktop\USD67,884.08_Payment_Advise_9083008849.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Uclldrv.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Source: Yara match | File source: 00000005.00000002.472146872.00000000026A7000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.468175139.00000000023E0000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.469055192.00000000025F0000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.473298428.0000000002797000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000003.358872577.0000000000852000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000003.281256788.00000000006D0000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.477031647.0000000004A10000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.474318013.00000000036C1000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.468146329.00000000021D4000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.467456643.0000000002154000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.473405683.00000000035D1000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.477297812.0000000004F00000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: Uclldrv.exe PID: 6868, type: MEMORY |
Source: Yara match | File source: Process Memory Space: USD67,884.08_Payment_Advise_9083008849.exe PID: 6248, type: MEMORY |
Source: Yara match | File source: 18.2.Uclldrv.exe.25f0000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 18.2.Uclldrv.exe.25f0000.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 5.2.USD67,884.08_Payment_Advise_9083008849.exe.4a10000.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 18.2.Uclldrv.exe.4f00000.3.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 5.2.USD67,884.08_Payment_Advise_9083008849.exe.23e0000.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 18.2.Uclldrv.exe.4f00000.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 5.2.USD67,884.08_Payment_Advise_9083008849.exe.4a10000.4.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 5.2.USD67,884.08_Payment_Advise_9083008849.exe.23e0000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 00000005.00000002.472146872.00000000026A7000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.468175139.00000000023E0000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.469055192.00000000025F0000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.473298428.0000000002797000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000003.358872577.0000000000852000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000003.281256788.00000000006D0000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.477031647.0000000004A10000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.474318013.00000000036C1000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.468146329.00000000021D4000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.467456643.0000000002154000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.473405683.00000000035D1000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: 00000012.00000002.477297812.0000000004F00000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: Uclldrv.exe PID: 6868, type: MEMORY |
Source: Yara match | File source: Process Memory Space: USD67,884.08_Payment_Advise_9083008849.exe PID: 6248, type: MEMORY |
Source: Yara match | File source: 18.2.Uclldrv.exe.25f0000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 18.2.Uclldrv.exe.25f0000.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 5.2.USD67,884.08_Payment_Advise_9083008849.exe.4a10000.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 18.2.Uclldrv.exe.4f00000.3.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 5.2.USD67,884.08_Payment_Advise_9083008849.exe.23e0000.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 18.2.Uclldrv.exe.4f00000.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 5.2.USD67,884.08_Payment_Advise_9083008849.exe.4a10000.4.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 5.2.USD67,884.08_Payment_Advise_9083008849.exe.23e0000.1.raw.unpack, type: UNPACKEDPE |