Windows Analysis Report
41e0000.dll

Overview

General Information

Sample Name: 41e0000.dll
Analysis ID: 556767
MD5: da4fab67f5cdf49208bb9065d7b7d1e7
SHA1: d7a399ace98716325d336e10b71049ed2bb7cc97
SHA256: 73118c724e0d6cb9ce3072d66f2d20fb7e89189699faf60315395ad89b0a1a4d
Tags: dllGozi
Infos:

Detection

Ursnif
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Antivirus / Scanner detection for submitted sample
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Writes or reads registry keys via WMI
Found API chain indicative of debugger detection
Machine Learning detection for sample
Found evasive API chain (may stop execution after checking system information)
Sigma detected: Suspicious Call by Ordinal
Writes registry values via WMI
Uses 32bit PE files
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Tries to load missing DLLs
Found evasive API chain checking for process token information
Registers a DLL
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Found malware configuration
Source: 41e0000.dll Malware Configuration Extractor: Ursnif {"RSA Public Key": "L5XnpbZDZwjvtdXTG9D+0vpQ0WIQnm12WOsOMOY8C0yZ7uOO/eBAY3rRXOCK/HxUxcqHiLwWMv8OvVRdmADoR5C7qw+W+cmADKOssMx4QiixdssL8i0K6IvsmBdkFnvRkNvUbwafGiXZrtbBpLj4f/dJ3w7XW3RjSkw+RqYMas1hhtruQoCk1je7YCKOglQr3mfAbgpC1wKDrJsVlm3Ee2FRygxJ/unIJjuf4cZ9D6dS7R4sAgvdtyH3+wA2XLiQ8coXu/ZgQWI5JUyTlSoIq9Jrn3krKqyPoEdC9NZR55AzbtfTqGZcRBQ1iIaAbKbolS/V8PvDuVzyEAYl31lkv8FesJrfZhohJsac0CyUvKU=", "c2_domain": ["museumistat.bar", "nnnnnn.bar", "nnnnnn.casa"], "botnet": "7576", "server": "50", "serpent_key": "WTkaI9ByCrqqeRAr", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
Multi AV Scanner detection for submitted file
Source: 41e0000.dll ReversingLabs: Detection: 46%
Antivirus / Scanner detection for submitted sample
Source: 41e0000.dll Avira: detected
Antivirus detection for URL or domain
Source: http://www.nnnnnn.casa/drew/gKT0MlKWG38_2/BMau4Oul/cEXy48BAqFiRWaKy3Hmuv38/3RbGiyCyh2/l1GuJ4tJh6rYVcx3P/CJUEexxeLegN/asUAVrcr8Os/6Heu8XQ9NwKS3r/RsXyOEKXh6_2Fk8FF_2Be/55GNIEO4rqxc9s7n/ukqCx_2FTaQH3qL/wkmTl5GH5xOHOuPfEe/BWDc8XF7Q/Aj_2BpbOenr9CVTaE_2B/XdQQRARWLLAVNpj0F5Y/DhKfHWf2CN42/6CU_2FsM/oq0.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/drew/aO1m2qbhzR/PyScSysfUMu7pQ56N/VjOvZCjAa_2F/1mYmXVIR1Zt/ZytsC9Ykmf_2Fu/iu9BdbHsH649dhw5xv4AE/uvJRR2pHSfmCL3mX/qVeQLGXMe6qLR0u/Wt56BLAa0ngbKPNWJl/aK0_2FM_2/B_2FgePTZg5J6aAm67BS/UxRCj8tcca1XehAjtUd/YhkFvH3YtE1Pt1_2BwmyD7/71NTX8ZhkOA2A/ekCIE_2B/Axlx1Zu2c2Fm5fnQIZEKkDy/m.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/ Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/dre Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/MeZUUlMrrzCrTTo/WRQsq4b7fIDR_2F2ui/K6Zod5HZQ/pReKsZQJuAIiqXNhcotr/27SAvb0lLGD4m4MtFqv/lionnkJutjVCo9Od2amHc6/vcomrgcHuTiyu/619f5X9g/OqezXl3127vZEQSYuxkxeXa/jXToImScJb/S5cz6j_2Fse9g4BcM/g7zL04pozIiS/_2B_2FN5VMo/ZAlJdIbg2SlHI1/d8no93Q9ma7mUN4PubD3o/tloZKX2Kmj/q.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2/qg8dX3i_2/BKHu1GhglPcxgFFzOwll/mE2uKWB4mhjJIhyxTbk/_2F4mS5i039Fc7Qu_2Bekr/iQMweYWStlPtj/o4jxWrxk/qxdFPQJxNpwFwYEvbalIklB/QVqGaFPam2/C2rQw2gzAO6yhP_2F/dkOEushjYAis/iro3PbyNh/HGAz2Q_2F/i0Bn.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXKRWnS Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/eLhw7nu1K6FTq/stO2JZ1h/n1J6MMYac0r5XgMvFx5tBMd/79pB3BpRVf/FsRkAxNC5o0VI8z66/ Avira URL Cloud: Label: malware
Source: http://museumistat.bar/drew/4iG_2BGMJbK_2Fz5Q7E/OfnzhNXmjy08XAO4hBOEsU/_2FWo4bkEDMbg/aulR18j2/5zekh_ Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2/qg8dX3i_2/BKHu1GhglPcxgFFzOwll/mE2uKWB4mhjJIhyxTbk/_2F4mS5i039Fc7Qu_2Bekr/iQMweYWStlPtj/o4jxWrxk/qxdFPQJxNpwFwYEvbalIklB/QVqGaFPam2/C2rQw2gzAO6yhP_2F/dkOEushjYAis/iro3PbyNh/HGAz2Q_2F/i0Bn.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/BVo0JfnyET/LCuKNvyhPvtrfvUnc/mObdgwXcgrZe/zSKG23eDqpN/HkpkBNiTxuWbBP/jak_2BPpM4WA8X4iaERBU/M_2BNnZd3vNVKd3D/snYYJ6wnfiJDJcL/92irgYdy9jdt7bObTQ/XthL2dpz7/ChmMUV7DDxy9eem0RAqA/QIh0WdqUZEhxu0X9j_2/F2lcfFWCQ7qV66laejvuEP/BvotBkMbOhSl5/Azm9mu3j/3M1GGyFrveB8gl1/M.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/drew/MeZUUlMrrzCrTTo/WRQsq4b7fIDR_2F2ui/K6Zod5HZQ/pReKsZQJuAIiqXNhcotr/27SAvb0lLGD4m4MtFqv/lionnkJutjVCo9Od2amHc6/vcomrgcHuTiyu/619f5X9g/OqezXl3127vZEQSYuxkxeXa/jXToImScJb/S5cz6j_2Fse9g4BcM/g7zL04pozIiS/_2B_2FN5VMo/ZAlJdIbg2SlHI1/d8no93Q9ma7mUN4PubD3o/tloZKX2Kmj/q.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/SDWuXQsskkRv/UNsc0mp28hP/x_2B_2FFq_2BHQ/F27_2FxKayrB3Cjy97Qhx/v8nlOT4QFPkzm4Ie/eAXoVlzzaxz8tgI/QR3P1Uk2I7ZbwimQXR/OfOcdTcUh/zjDQ5XVxR1cI0bdt8PDF/mZjcYY9L2vv_2BELjHj/Y7ijGd_2F3psmxh_2FsXvv/mj29lZ4n/h.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar Avira URL Cloud: Label: malware
Source: http://museumistat.bar Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/nnnnnn.casa5 Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0O8/4fSjQKFRypPXeHUM/2VwdsjoRmoerb1g/N6r4i0t9F_2FA66_2F/CrVcoXDX5/D2kSFR1VHNVLT3GtdrVC/2IzirCs34EDnFYvNPWY/fYM6gayTm5L9yWZL2Vx5Nc/R0anH3ZYvesfP/30v94E34/TL40v70SibYCobhKHsZEJ7c/OLRlO.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2 Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/2dHt0g0ZxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t63S3GMZiTKRdq/jvCj1 Avira URL Cloud: Label: malware
Source: http://museumistat.bar/drew/ammuwrNq_/2BqepYvRFV9AqHabqa_2/F1YKJqeJLi3jEjiQLE2/U5afXyZSkYxg9zlQghLCU Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8dXb3jJiK/zds9L6K3nZZ7oSB_2FRe/J_2F81pI4nTjSy_2FLT/d8Gf2VlN_2BGJ3KTHQhxNU/PK1lsXUZsV6B7/COUqQ3wX/120xfpxJZhcCTcDgyQOQ47a/2BRczUrfQU/ppPj1HI3Q0OhFDCjv/4_2Br67LS5pR/l5aWeKuI6uG/ni53ezQ1izt/Yu.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzSdCW3EjFkfnBVLNrh/u6iSfeXnIxEc4/iOpnKu8_/2B6ER0J96Uzbim1bUMtmrJq/DMYICZNGt5/BH1k0iCPsGbgr2jmq/LZISYUDUDQ3s/sBmfD_2B_2F/KeRIfCDg82xxJ1/5QkNXVsBvP5NPb2r4nyOG/rCLwK7C8JPaslI4x/C4pqB4g_2/B.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzSdCW3EjFkfnBVLNrh/u6iSfeXnIxEc4/iOpnKu8_/2B6ER0J96Uzbim1bUMtmrJq/DMYICZNGt5/BH1k0iCPsGbgr2jmq/LZISYUDUDQ3s/sBmfD_2B_2F/KeRIfCDg82xxJ1/5QkNXVsBvP5NPb2r4nyOG/rCLwK7C8JPaslI4x/C4pqB4g_2/B.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughe Avira URL Cloud: Label: malware
Source: http://museumistat.bar/drew/XMU8iofODBy1lrN0vdkRj/PLODd_2Bhig1hkqI/Wigiwyx9ltM_2Fd/r36Wr8ytAbQS3wDa6 Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8dXb3jJiK/zds9L6K3nZZ7oSB_2FRe/J_2F81pI4nTjSy_2FLT/d8Gf2VlN_2BGJ3KTHQhxNU/PK1lsXUZsV6B7/COUqQ3wX/120xfpxJZhcCTcDgyQOQ47a/2BRczUrfQU/ppPj1HI3Q0OhFDCjv/4_2Br67LS5pR/l5aWeKuI6uG/ni53ezQ1izt/Yu.jlk Avira URL Cloud: Label: malware
Source: http://museumistat.bar/ Avira URL Cloud: Label: malware
Source: http://museumistat.bar/drew/tizLy41OuYHIsTgBNj/0Uu4NPNlH/3sO8ziJptuwkpagoG2Xn/2Wzxx3rAW_2F6s4Zntp/4O Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9 Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/drew/eLhw7nu1K6FTq/stO2JZ1h/n1J6MMYac0r5XgMvFx5tBMd/79pB3BpRVf/FsRkAxNC5o0VI8 Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/SDWuXQsskkRv/UNsc0mp28hP/x_2B_2FFq_2BHQ/F27_2FxKayrB3Cjy97Qhx/v8nlOT4QFPkzm4Ie/eAXoVlzzaxz8tgI/QR3P1Uk2I7ZbwimQXR/OfOcdTcUh/zjDQ5XVxR1cI0bdt8PDF/mZjcYY9L2vv_2BELjHj/Y7ijGd_2F3psmxh_2FsXvv/mj29lZ4n/h.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/drew/BVo0JfnyET/LCuKNvyhPvtrfvUnc/mObdgwXcgrZe/zSKG23eDqpN/HkpkBNiTxuWbBP/jak_2BPpM4WA8X4iaERBU/M_2BNnZd3vNVKd3D/snYYJ6wnfiJDJcL/92irgYdy9jdt7bObTQ/XthL2dpz7/ChmMUV7DDxy9eem0RAqA/QIh0WdqUZEhxu0X9j_2/F2lcfFWCQ7qV66laejvuEP/BvotBkMbOhSl5/Azm9mu3j/3M1GGyFrveB8gl1/M.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2/qg8 Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8d Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughemPo02ekn/fOGpqXigagMOIeoi2whU2K/VcKgvpNbHoVGC/D5UC9izH/aHNIhYwGohjos0FQ6xviFWf/oAZv_2Bi_2/FQiT5Hhg78q185o5l/RS9K9tlnC9cl/irJKo_2Bc3F/Cv7H0DN6I4ItJ9/fG_2BK5HpVFIp2pJnaZ2D/aV8ATJwwcAP/_2Bs.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0 Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.casa/ Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzS Avira URL Cloud: Label: malware
Source: http://museumistat.bar/icies Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughemPo02ekn/fOGpqXigagMOIeoi2whU2K/VcKgvpNbHoVGC/D5UC9izH/aHNIhYwGohjos0FQ6xviFWf/oAZv_2Bi_2/FQiT5Hhg78q185o5l/RS9K9tlnC9cl/irJKo_2Bc3F/Cv7H0DN6I4ItJ9/fG_2BK5HpVFIp2pJnaZ2D/aV8ATJwwcAP/_2Bs.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/g Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/f Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/wl Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXKRWnS/sNuzGwvgFbGuiX/cYwNdjWOtQd_2Fg50Gq6_/2FjOiJCVbSj9xwyh/G_2BXTVzOZQxb5p/q_2BNRYwk1baG5TnLz/jbdiar_2B/vITHroP6B_2F_2BAIZUm/KtOtUG2G23eAdJDsUmd/Q0nO6sNJelOrTMnHEyXMkV/0ho4YTGcPihXz/P5SVPgNqDh/MwH.jlk Avira URL Cloud: Label: malware
Source: http://www.nnnnnn.bar/drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXK Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/gKT0MlKWG38_2/BMau4Oul/cEXy48BAqFiRWaKy3Hmuv38/3RbGiyCyh2/l1GuJ4tJh6rYVcx3P/CJUEexxeLegN/asUAVrcr8Os/6Heu8XQ9NwKS3r/RsXyOEKXh6_2Fk8FF_2Be/55GNIEO4rqxc9s7n/ukqCx_2FTaQH3qL/wkmTl5GH5xOHOuPfEe/BWDc8XF7Q/Aj_2BpbOenr9CVTaE_2B/XdQQRARWLLAVNpj0F5Y/DhKfHWf2CN42/6CU_2FsM/oq0.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/aO1m2qbhzR/PyScSysfUMu7pQ56N/VjOvZCjAa_2F/1mYmXVIR1Zt/ZytsC9Ykmf_2Fu/iu9BdbHsH649dhw5xv4AE/uvJRR2pHSfmCL3mX/qVeQLGXMe6qLR0u/Wt56BLAa0ngbKPNWJl/aK0_2FM_2/B_2FgePTZg5J6aAm67BS/UxRCj8tcca1XehAjtUd/YhkFvH3YtE1Pt1_2BwmyD7/71NTX8ZhkOA2A/ekCIE_2B/Axlx1Zu2c2Fm5fnQIZEKkDy/m.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/gKT0MlKWG38_2/BMau4Oul/cEXy48BAqFiRWaKy3Hmuv38/3RbGiyCyh2/l1GuJ4tJh6rYVcx3P/ Avira URL Cloud: Label: malware
Source: http://nnnnnn.casa/drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/ Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/BVo0JfnyET/LCuKNvyhPvtrfvUnc/mObdgwXcgrZe/zSKG23eDqpN/HkpkBNiTxuWbBP/jak_2BPp Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0O8/4fSjQKFRypPXeHUM/2VwdsjoRmoerb1g/N6r4i0t9F_2FA66_2F/CrVcoXDX5/D2kSFR1VHNVLT3GtdrVC/2IzirCs34EDnFYvNPWY/fYM6gayTm5L9yWZL2Vx5Nc/R0anH3ZYvesfP/30v94E34/TL40v70SibYCobhKHsZEJ7c/OLRlO.jlk Avira URL Cloud: Label: malware
Source: http://nnnnnn.bar/drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXKRWnS/sNuzGwvgFbGuiX/cYwNdjWOtQd_2Fg50Gq6_/2FjOiJCVbSj9xwyh/G_2BXTVzOZQxb5p/q_2BNRYwk1baG5TnLz/jbdiar_2B/vITHroP6B_2F_2BAIZUm/KtOtUG2G23eAdJDsUmd/Q0nO6sNJelOrTMnHEyXMkV/0ho4YTGcPihXz/P5SVPgNqDh/MwH.jlk Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: nnnnnn.bar Virustotal: Detection: 6% Perma Link
Source: nnnnnn.casa Virustotal: Detection: 5% Perma Link
Source: museumistat.bar Virustotal: Detection: 11% Perma Link
Source: www.nnnnnn.casa Virustotal: Detection: 7% Perma Link
Machine Learning detection for sample
Source: 41e0000.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 0.2.loaddll32.exe.10000000.2.unpack Avira: Label: TR/Crypt.XPACK.Gen8
Source: 5.2.rundll32.exe.10000000.2.unpack Avira: Label: TR/Crypt.XPACK.Gen8
Source: 4.2.rundll32.exe.10000000.2.unpack Avira: Label: TR/Crypt.XPACK.Gen8
Source: 3.2.regsvr32.exe.10000000.2.unpack Avira: Label: TR/Crypt.XPACK.Gen8

Cryptography
barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B74872 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 0_2_00B74872
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E4872 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 4_2_046E4872
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C74872 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 5_2_00C74872

Compliance
barindex
Uses 32bit PE files
Source: 41e0000.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Networking
barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49777 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49777 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49779 -> 198.54.117.216:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49779 -> 198.54.117.216:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49780 -> 198.54.117.216:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49780 -> 198.54.117.216:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49781 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49781 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49784 -> 198.54.117.216:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49784 -> 198.54.117.216:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49786 -> 198.54.117.211:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49786 -> 198.54.117.211:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49828 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49831 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49833 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49836 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49836 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49837 -> 198.54.117.211:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49840 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49840 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49838 -> 198.54.117.211:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49839 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49839 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49842 -> 198.54.117.211:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49843 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49843 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49844 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49844 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49846 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49846 -> 198.54.117.210:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49848 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49849 -> 198.54.117.215:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49850 -> 198.54.117.215:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49852 -> 198.54.117.215:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49853 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49853 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49855 -> 198.54.117.217:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49855 -> 198.54.117.217:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49857 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49859 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49865 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49865 -> 192.64.119.233:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49868 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49868 -> 198.54.117.218:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49871 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49872 -> 198.54.117.216:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49873 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49873 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49874 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49874 -> 162.255.119.177:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49875 -> 198.54.117.217:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49875 -> 198.54.117.217:80
Source: Traffic Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49876 -> 198.54.117.216:80
Source: Traffic Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49876 -> 198.54.117.216:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 198.54.117.217 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 198.54.117.218 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: museumistat.bar
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: www.nnnnnn.casa
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 162.255.119.177 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: nnnnnn.casa
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: www.nnnnnn.bar
Source: C:\Windows\SysWOW64\regsvr32.exe Domain query: nnnnnn.bar
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 192.64.119.233 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 198.54.117.216 80 Jump to behavior
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 198.54.117.217 198.54.117.217
Source: msapplication.xml0.14.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xb7861f03,0x01d80e3f</date><accdate>0xb7ba9365,0x01d80e3f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.14.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xbb57a28b,0x01d80e3f</date><accdate>0xbba3ee59,0x01d80e3f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.14.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xbcea8f74,0x01d80e3f</date><accdate>0xbd642904,0x01d80e3f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: rundll32.exe, 00000005.00000003.445989314.0000000000B13000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000003.300466996.0000000000B22000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000003.490164133.0000000000B23000.00000004.00000001.sdmp String found in binary or memory: http://museumistat.bar
Source: regsvr32.exe, 00000003.00000002.783677906.0000000002D79000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000003.777130443.0000000002D79000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000003.605295288.0000000002D79000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000002.783462582.0000000002D48000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp String found in binary or memory: http://museumistat.bar/
Source: regsvr32.exe, 00000003.00000002.783462582.0000000002D48000.00000004.00000020.sdmp String found in binary or memory: http://museumistat.bar/drew/4iG_2BGMJbK_2Fz5Q7E/OfnzhNXmjy08XAO4hBOEsU/_2FWo4bkEDMbg/aulR18j2/5zekh_
Source: ~DF46B8E1B94B04B19A.TMP.34.dr, {1187F3F8-7A33-11EC-90E5-ECF4BB570DC9}.dat.34.dr String found in binary or memory: http://museumistat.bar/drew/XMU8iofODBy1lrN0vdkRj/PLODd_2Bhig1hkqI/Wigiwyx9ltM_2Fd/r36Wr8ytAbQS3wDa6
Source: ~DF39FCB87D136FE619.TMP.14.dr, {DF65E4B8-7A32-11EC-90E5-ECF4BB570DC9}.dat.14.dr String found in binary or memory: http://museumistat.bar/drew/ammuwrNq_/2BqepYvRFV9AqHabqa_2/F1YKJqeJLi3jEjiQLE2/U5afXyZSkYxg9zlQghLCU
Source: regsvr32.exe, 00000003.00000003.460394467.0000000002D7C000.00000004.00000001.sdmp, ~DF0DFA2E9BDD010B64.TMP.28.dr, {0D9E988A-7A33-11EC-90E5-ECF4BB570DC9}.dat.28.dr, {0D9E988C-7A33-11EC-90E5-ECF4BB570DC9}.dat.28.dr, ~DFF8FC7C7342251397.TMP.28.dr String found in binary or memory: http://museumistat.bar/drew/jDwFdEqJ/e48LyDsSt1xLSBAUeszs4Wk/a4WMv6xPKv/K45qV_2BrlBb8GeVJ/xA726fz2EH
Source: {0789B96E-7A33-11EC-90E5-ECF4BB570DC9}.dat.28.dr, ~DF516DF10BC96611FB.TMP.28.dr String found in binary or memory: http://museumistat.bar/drew/stiLnI_2FIOaNz22iC/XhTXRubVp/vO3TKKbHtD6iLkyJCmMU/4kOpofPxPR7lhueSnFw/gd
Source: rundll32.exe, 00000005.00000002.781904835.0000000000B11000.00000004.00000020.sdmp String found in binary or memory: http://museumistat.bar/drew/tizLy41OuYHIsTgBNj/0Uu4NPNlH/3sO8ziJptuwkpagoG2Xn/2Wzxx3rAW_2F6s4Zntp/4O
Source: rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp String found in binary or memory: http://museumistat.bar/icies
Source: regsvr32.exe, 00000003.00000002.783242972.0000000002D0A000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp String found in binary or memory: http://nnnnnn.bar
Source: rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.781904835.0000000000B11000.00000004.00000020.sdmp String found in binary or memory: http://nnnnnn.bar/drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2/qg8
Source: rundll32.exe, 00000005.00000002.785176954.00000000044CB000.00000004.00000010.sdmp String found in binary or memory: http://nnnnnn.bar/drew/2dHt0g0ZxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t63S3GMZiTKRdq/jvCj1
Source: {18677AFC-7A33-11EC-90E5-ECF4BB570DC9}.dat.37.dr, ~DFF9AFC0207BE9256F.TMP.37.dr String found in binary or memory: http://nnnnnn.bar/drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9
Source: rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp, {18677AF8-7A33-11EC-90E5-ECF4BB570DC9}.dat.37.dr, ~DFBFD7520757EE7FA8.TMP.37.dr String found in binary or memory: http://nnnnnn.bar/drew/BVo0JfnyET/LCuKNvyhPvtrfvUnc/mObdgwXcgrZe/zSKG23eDqpN/HkpkBNiTxuWbBP/jak_2BPp
Source: regsvr32.exe, 00000003.00000002.783242972.0000000002D0A000.00000004.00000020.sdmp, ~DFF5EADCEC42896510.TMP.37.dr, {18677AFA-7A33-11EC-90E5-ECF4BB570DC9}.dat.37.dr String found in binary or memory: http://nnnnnn.bar/drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0
Source: {2030A8D5-7A33-11EC-90E5-ECF4BB570DC9}.dat.42.dr, ~DF9357A3070BEC43BD.TMP.42.dr String found in binary or memory: http://nnnnnn.bar/drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughe
Source: regsvr32.exe, 00000003.00000002.783242972.0000000002D0A000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000002.783677906.0000000002D79000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000003.777130443.0000000002D79000.00000004.00000001.sdmp String found in binary or memory: http://nnnnnn.bar/drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXKRWnS
Source: regsvr32.exe, 00000003.00000003.460284277.0000000002D7C000.00000004.00000001.sdmp String found in binary or memory: http://nnnnnn.casa
Source: rundll32.exe, 00000005.00000003.562206472.0000000000B14000.00000004.00000001.sdmp String found in binary or memory: http://nnnnnn.casa/dre
Source: {FCCA6071-7A32-11EC-90E5-ECF4BB570DC9}.dat.23.dr, ~DFD008A2FC4BAFFBB5.TMP.23.dr String found in binary or memory: http://nnnnnn.casa/drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8d
Source: {FCCA6075-7A32-11EC-90E5-ECF4BB570DC9}.dat.23.dr, ~DF0FA6B24B5E37207F.TMP.23.dr String found in binary or memory: http://nnnnnn.casa/drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzS
Source: regsvr32.exe, 00000003.00000003.777130443.0000000002D79000.00000004.00000001.sdmp String found in binary or memory: http://nnnnnn.casa/drew/eLhw7nu1K6FTq/stO2JZ1h/n1J6MMYac0r5XgMvFx5tBMd/79pB3BpRVf/FsRkAxNC5o0VI8z66/
Source: {FCCA6073-7A32-11EC-90E5-ECF4BB570DC9}.dat.23.dr String found in binary or memory: http://nnnnnn.casa/drew/gKT0MlKWG38_2/BMau4Oul/cEXy48BAqFiRWaKy3Hmuv38/3RbGiyCyh2/l1GuJ4tJh6rYVcx3P/
Source: rundll32.exe, 00000005.00000003.562280336.0000000000B23000.00000004.00000001.sdmp String found in binary or memory: http://nnnnnn.casa/drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/
Source: msapplication.xml.14.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.14.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.14.dr String found in binary or memory: http://www.live.com/
Source: regsvr32.exe, 00000003.00000002.783643487.0000000002D6A000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000002.783462582.0000000002D48000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.bar/
Source: rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.781904835.0000000000B11000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.bar/drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2
Source: regsvr32.exe, 00000003.00000002.783582569.0000000002D61000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000002.783677906.0000000002D79000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000002.783462582.0000000002D48000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.bar/drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXK
Source: rundll32.exe, 00000005.00000002.781731263.0000000000B00000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.bar/f
Source: rundll32.exe, 00000005.00000002.781731263.0000000000B00000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.bar/g
Source: rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.bar/wl
Source: regsvr32.exe, 00000003.00000002.783677906.0000000002D79000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000003.777130443.0000000002D79000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000003.605295288.0000000002D79000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.casa/
Source: regsvr32.exe, 00000003.00000003.605357025.0000000002D97000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000002.783677906.0000000002D79000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000003.777130443.0000000002D79000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000002.783462582.0000000002D48000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.casa/drew/eLhw7nu1K6FTq/stO2JZ1h/n1J6MMYac0r5XgMvFx5tBMd/79pB3BpRVf/FsRkAxNC5o0VI8
Source: rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.781904835.0000000000B11000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.casa/drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr
Source: rundll32.exe, 00000005.00000002.781511015.0000000000AAA000.00000004.00000020.sdmp String found in binary or memory: http://www.nnnnnn.casa/nnnnnn.casa5
Source: regsvr32.exe, 00000003.00000003.559541248.0000000002D7B000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000003.558838390.0000000002D79000.00000004.00000001.sdmp String found in binary or memory: http://www.nnnnnn.casaw/eLhw7nu1K6FTq/stO2JZ1h/n1J6MMYac0r5XgMvFx5tBMd/79pB3BpRVf/FsRkAxNC5o0VI8z66/
Source: msapplication.xml3.14.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.14.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.14.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.14.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.14.dr String found in binary or memory: http://www.youtube.com/
Source: unknown DNS traffic detected: queries for: museumistat.bar
Source: global traffic HTTP traffic detected: GET /drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8dXb3jJiK/zds9L6K3nZZ7oSB_2FRe/J_2F81pI4nTjSy_2FLT/d8Gf2VlN_2BGJ3KTHQhxNU/PK1lsXUZsV6B7/COUqQ3wX/120xfpxJZhcCTcDgyQOQ47a/2BRczUrfQU/ppPj1HI3Q0OhFDCjv/4_2Br67LS5pR/l5aWeKuI6uG/ni53ezQ1izt/Yu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: nnnnnn.casaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8dXb3jJiK/zds9L6K3nZZ7oSB_2FRe/J_2F81pI4nTjSy_2FLT/d8Gf2VlN_2BGJ3KTHQhxNU/PK1lsXUZsV6B7/COUqQ3wX/120xfpxJZhcCTcDgyQOQ47a/2BRczUrfQU/ppPj1HI3Q0OhFDCjv/4_2Br67LS5pR/l5aWeKuI6uG/ni53ezQ1izt/Yu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8dXb3jJiK/zds9L6K3nZZ7oSB_2FRe/J_2F81pI4nTjSy_2FLT/d8Gf2VlN_2BGJ3KTHQhxNU/PK1lsXUZsV6B7/COUqQ3wX/120xfpxJZhcCTcDgyQOQ47a/2BRczUrfQU/ppPj1HI3Q0OhFDCjv/4_2Br67LS5pR/l5aWeKuI6uG/ni53ezQ1izt/Yu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/gKT0MlKWG38_2/BMau4Oul/cEXy48BAqFiRWaKy3Hmuv38/3RbGiyCyh2/l1GuJ4tJh6rYVcx3P/CJUEexxeLegN/asUAVrcr8Os/6Heu8XQ9NwKS3r/RsXyOEKXh6_2Fk8FF_2Be/55GNIEO4rqxc9s7n/ukqCx_2FTaQH3qL/wkmTl5GH5xOHOuPfEe/BWDc8XF7Q/Aj_2BpbOenr9CVTaE_2B/XdQQRARWLLAVNpj0F5Y/DhKfHWf2CN42/6CU_2FsM/oq0.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: nnnnnn.casaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8dXb3jJiK/zds9L6K3nZZ7oSB_2FRe/J_2F81pI4nTjSy_2FLT/d8Gf2VlN_2BGJ3KTHQhxNU/PK1lsXUZsV6B7/COUqQ3wX/120xfpxJZhcCTcDgyQOQ47a/2BRczUrfQU/ppPj1HI3Q0OhFDCjv/4_2Br67LS5pR/l5aWeKuI6uG/ni53ezQ1izt/Yu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/gKT0MlKWG38_2/BMau4Oul/cEXy48BAqFiRWaKy3Hmuv38/3RbGiyCyh2/l1GuJ4tJh6rYVcx3P/CJUEexxeLegN/asUAVrcr8Os/6Heu8XQ9NwKS3r/RsXyOEKXh6_2Fk8FF_2Be/55GNIEO4rqxc9s7n/ukqCx_2FTaQH3qL/wkmTl5GH5xOHOuPfEe/BWDc8XF7Q/Aj_2BpbOenr9CVTaE_2B/XdQQRARWLLAVNpj0F5Y/DhKfHWf2CN42/6CU_2FsM/oq0.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzSdCW3EjFkfnBVLNrh/u6iSfeXnIxEc4/iOpnKu8_/2B6ER0J96Uzbim1bUMtmrJq/DMYICZNGt5/BH1k0iCPsGbgr2jmq/LZISYUDUDQ3s/sBmfD_2B_2F/KeRIfCDg82xxJ1/5QkNXVsBvP5NPb2r4nyOG/rCLwK7C8JPaslI4x/C4pqB4g_2/B.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: nnnnnn.casaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzSdCW3EjFkfnBVLNrh/u6iSfeXnIxEc4/iOpnKu8_/2B6ER0J96Uzbim1bUMtmrJq/DMYICZNGt5/BH1k0iCPsGbgr2jmq/LZISYUDUDQ3s/sBmfD_2B_2F/KeRIfCDg82xxJ1/5QkNXVsBvP5NPb2r4nyOG/rCLwK7C8JPaslI4x/C4pqB4g_2/B.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzSdCW3EjFkfnBVLNrh/u6iSfeXnIxEc4/iOpnKu8_/2B6ER0J96Uzbim1bUMtmrJq/DMYICZNGt5/BH1k0iCPsGbgr2jmq/LZISYUDUDQ3s/sBmfD_2B_2F/KeRIfCDg82xxJ1/5QkNXVsBvP5NPb2r4nyOG/rCLwK7C8JPaslI4x/C4pqB4g_2/B.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzSdCW3EjFkfnBVLNrh/u6iSfeXnIxEc4/iOpnKu8_/2B6ER0J96Uzbim1bUMtmrJq/DMYICZNGt5/BH1k0iCPsGbgr2jmq/LZISYUDUDQ3s/sBmfD_2B_2F/KeRIfCDg82xxJ1/5QkNXVsBvP5NPb2r4nyOG/rCLwK7C8JPaslI4x/C4pqB4g_2/B.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/BVo0JfnyET/LCuKNvyhPvtrfvUnc/mObdgwXcgrZe/zSKG23eDqpN/HkpkBNiTxuWbBP/jak_2BPpM4WA8X4iaERBU/M_2BNnZd3vNVKd3D/snYYJ6wnfiJDJcL/92irgYdy9jdt7bObTQ/XthL2dpz7/ChmMUV7DDxy9eem0RAqA/QIh0WdqUZEhxu0X9j_2/F2lcfFWCQ7qV66laejvuEP/BvotBkMbOhSl5/Azm9mu3j/3M1GGyFrveB8gl1/M.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: nnnnnn.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /drew/BVo0JfnyET/LCuKNvyhPvtrfvUnc/mObdgwXcgrZe/zSKG23eDqpN/HkpkBNiTxuWbBP/jak_2BPpM4WA8X4iaERBU/M_2BNnZd3vNVKd3D/snYYJ6wnfiJDJcL/92irgYdy9jdt7bObTQ/XthL2dpz7/ChmMUV7DDxy9eem0RAqA/QIh0WdqUZEhxu0X9j_2/F2lcfFWCQ7qV66laejvuEP/BvotBkMbOhSl5/Azm9mu3j/3M1GGyFrveB8gl1/M.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0O8/4fSjQKFRypPXeHUM/2VwdsjoRmoerb1g/N6r4i0t9F_2FA66_2F/CrVcoXDX5/D2kSFR1VHNVLT3GtdrVC/2IzirCs34EDnFYvNPWY/fYM6gayTm5L9yWZL2Vx5Nc/R0anH3ZYvesfP/30v94E34/TL40v70SibYCobhKHsZEJ7c/OLRlO.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: nnnnnn.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: nnnnnn.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0O8/4fSjQKFRypPXeHUM/2VwdsjoRmoerb1g/N6r4i0t9F_2FA66_2F/CrVcoXDX5/D2kSFR1VHNVLT3GtdrVC/2IzirCs34EDnFYvNPWY/fYM6gayTm5L9yWZL2Vx5Nc/R0anH3ZYvesfP/30v94E34/TL40v70SibYCobhKHsZEJ7c/OLRlO.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0O8/4fSjQKFRypPXeHUM/2VwdsjoRmoerb1g/N6r4i0t9F_2FA66_2F/CrVcoXDX5/D2kSFR1VHNVLT3GtdrVC/2IzirCs34EDnFYvNPWY/fYM6gayTm5L9yWZL2Vx5Nc/R0anH3ZYvesfP/30v94E34/TL40v70SibYCobhKHsZEJ7c/OLRlO.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0O8/4fSjQKFRypPXeHUM/2VwdsjoRmoerb1g/N6r4i0t9F_2FA66_2F/CrVcoXDX5/D2kSFR1VHNVLT3GtdrVC/2IzirCs34EDnFYvNPWY/fYM6gayTm5L9yWZL2Vx5Nc/R0anH3ZYvesfP/30v94E34/TL40v70SibYCobhKHsZEJ7c/OLRlO.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughemPo02ekn/fOGpqXigagMOIeoi2whU2K/VcKgvpNbHoVGC/D5UC9izH/aHNIhYwGohjos0FQ6xviFWf/oAZv_2Bi_2/FQiT5Hhg78q185o5l/RS9K9tlnC9cl/irJKo_2Bc3F/Cv7H0DN6I4ItJ9/fG_2BK5HpVFIp2pJnaZ2D/aV8ATJwwcAP/_2Bs.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: nnnnnn.barConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughemPo02ekn/fOGpqXigagMOIeoi2whU2K/VcKgvpNbHoVGC/D5UC9izH/aHNIhYwGohjos0FQ6xviFWf/oAZv_2Bi_2/FQiT5Hhg78q185o5l/RS9K9tlnC9cl/irJKo_2Bc3F/Cv7H0DN6I4ItJ9/fG_2BK5HpVFIp2pJnaZ2D/aV8ATJwwcAP/_2Bs.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughemPo02ekn/fOGpqXigagMOIeoi2whU2K/VcKgvpNbHoVGC/D5UC9izH/aHNIhYwGohjos0FQ6xviFWf/oAZv_2Bi_2/FQiT5Hhg78q185o5l/RS9K9tlnC9cl/irJKo_2Bc3F/Cv7H0DN6I4ItJ9/fG_2BK5HpVFIp2pJnaZ2D/aV8ATJwwcAP/_2Bs.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughemPo02ekn/fOGpqXigagMOIeoi2whU2K/VcKgvpNbHoVGC/D5UC9izH/aHNIhYwGohjos0FQ6xviFWf/oAZv_2Bi_2/FQiT5Hhg78q185o5l/RS9K9tlnC9cl/irJKo_2Bc3F/Cv7H0DN6I4ItJ9/fG_2BK5HpVFIp2pJnaZ2D/aV8ATJwwcAP/_2Bs.jlk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/SDWuXQsskkRv/UNsc0mp28hP/x_2B_2FFq_2BHQ/F27_2FxKayrB3Cjy97Qhx/v8nlOT4QFPkzm4Ie/eAXoVlzzaxz8tgI/QR3P1Uk2I7ZbwimQXR/OfOcdTcUh/zjDQ5XVxR1cI0bdt8PDF/mZjcYY9L2vv_2BELjHj/Y7ijGd_2F3psmxh_2FsXvv/mj29lZ4n/h.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: nnnnnn.casaConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/SDWuXQsskkRv/UNsc0mp28hP/x_2B_2FFq_2BHQ/F27_2FxKayrB3Cjy97Qhx/v8nlOT4QFPkzm4Ie/eAXoVlzzaxz8tgI/QR3P1Uk2I7ZbwimQXR/OfOcdTcUh/zjDQ5XVxR1cI0bdt8PDF/mZjcYY9L2vv_2BELjHj/Y7ijGd_2F3psmxh_2FsXvv/mj29lZ4n/h.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: nnnnnn.casaConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/SDWuXQsskkRv/UNsc0mp28hP/x_2B_2FFq_2BHQ/F27_2FxKayrB3Cjy97Qhx/v8nlOT4QFPkzm4Ie/eAXoVlzzaxz8tgI/QR3P1Uk2I7ZbwimQXR/OfOcdTcUh/zjDQ5XVxR1cI0bdt8PDF/mZjcYY9L2vv_2BELjHj/Y7ijGd_2F3psmxh_2FsXvv/mj29lZ4n/h.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/eLhw7nu1K6FTq/stO2JZ1h/n1J6MMYac0r5XgMvFx5tBMd/79pB3BpRVf/FsRkAxNC5o0VI8z66/KTISrjoFRwGk/8f5Gk94fzsF/M9kxRuEmDiLC4g/C5CJDIhm32RcEsrXpX1cl/nhp48i6KKa2Q6Lfc/czZpTR7aDJA6t9d/77J9nH6eS_2BFp56QM/mTLCmOjMG/MA276CfB7XMe3BWYe2He/jQHDpUYGJBhhozuIZzR/2y_2F3GFZEVf/J.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: nnnnnn.casaConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/MeZUUlMrrzCrTTo/WRQsq4b7fIDR_2F2ui/K6Zod5HZQ/pReKsZQJuAIiqXNhcotr/27SAvb0lLGD4m4MtFqv/lionnkJutjVCo9Od2amHc6/vcomrgcHuTiyu/619f5X9g/OqezXl3127vZEQSYuxkxeXa/jXToImScJb/S5cz6j_2Fse9g4BcM/g7zL04pozIiS/_2B_2FN5VMo/ZAlJdIbg2SlHI1/d8no93Q9ma7mUN4PubD3o/tloZKX2Kmj/q.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: nnnnnn.casaConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/eLhw7nu1K6FTq/stO2JZ1h/n1J6MMYac0r5XgMvFx5tBMd/79pB3BpRVf/FsRkAxNC5o0VI8z66/KTISrjoFRwGk/8f5Gk94fzsF/M9kxRuEmDiLC4g/C5CJDIhm32RcEsrXpX1cl/nhp48i6KKa2Q6Lfc/czZpTR7aDJA6t9d/77J9nH6eS_2BFp56QM/mTLCmOjMG/MA276CfB7XMe3BWYe2He/jQHDpUYGJBhhozuIZzR/2y_2F3GFZEVf/J.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/MeZUUlMrrzCrTTo/WRQsq4b7fIDR_2F2ui/K6Zod5HZQ/pReKsZQJuAIiqXNhcotr/27SAvb0lLGD4m4MtFqv/lionnkJutjVCo9Od2amHc6/vcomrgcHuTiyu/619f5X9g/OqezXl3127vZEQSYuxkxeXa/jXToImScJb/S5cz6j_2Fse9g4BcM/g7zL04pozIiS/_2B_2FN5VMo/ZAlJdIbg2SlHI1/d8no93Q9ma7mUN4PubD3o/tloZKX2Kmj/q.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/aO1m2qbhzR/PyScSysfUMu7pQ56N/VjOvZCjAa_2F/1mYmXVIR1Zt/ZytsC9Ykmf_2Fu/iu9BdbHsH649dhw5xv4AE/uvJRR2pHSfmCL3mX/qVeQLGXMe6qLR0u/Wt56BLAa0ngbKPNWJl/aK0_2FM_2/B_2FgePTZg5J6aAm67BS/UxRCj8tcca1XehAjtUd/YhkFvH3YtE1Pt1_2BwmyD7/71NTX8ZhkOA2A/ekCIE_2B/Axlx1Zu2c2Fm5fnQIZEKkDy/m.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: nnnnnn.casaConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/aO1m2qbhzR/PyScSysfUMu7pQ56N/VjOvZCjAa_2F/1mYmXVIR1Zt/ZytsC9Ykmf_2Fu/iu9BdbHsH649dhw5xv4AE/uvJRR2pHSfmCL3mX/qVeQLGXMe6qLR0u/Wt56BLAa0ngbKPNWJl/aK0_2FM_2/B_2FgePTZg5J6aAm67BS/UxRCj8tcca1XehAjtUd/YhkFvH3YtE1Pt1_2BwmyD7/71NTX8ZhkOA2A/ekCIE_2B/Axlx1Zu2c2Fm5fnQIZEKkDy/m.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.nnnnnn.casa
Source: global traffic HTTP traffic detected: GET /drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2/qg8dX3i_2/BKHu1GhglPcxgFFzOwll/mE2uKWB4mhjJIhyxTbk/_2F4mS5i039Fc7Qu_2Bekr/iQMweYWStlPtj/o4jxWrxk/qxdFPQJxNpwFwYEvbalIklB/QVqGaFPam2/C2rQw2gzAO6yhP_2F/dkOEushjYAis/iro3PbyNh/HGAz2Q_2F/i0Bn.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: nnnnnn.barConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2/qg8dX3i_2/BKHu1GhglPcxgFFzOwll/mE2uKWB4mhjJIhyxTbk/_2F4mS5i039Fc7Qu_2Bekr/iQMweYWStlPtj/o4jxWrxk/qxdFPQJxNpwFwYEvbalIklB/QVqGaFPam2/C2rQw2gzAO6yhP_2F/dkOEushjYAis/iro3PbyNh/HGAz2Q_2F/i0Bn.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXKRWnS/sNuzGwvgFbGuiX/cYwNdjWOtQd_2Fg50Gq6_/2FjOiJCVbSj9xwyh/G_2BXTVzOZQxb5p/q_2BNRYwk1baG5TnLz/jbdiar_2B/vITHroP6B_2F_2BAIZUm/KtOtUG2G23eAdJDsUmd/Q0nO6sNJelOrTMnHEyXMkV/0ho4YTGcPihXz/P5SVPgNqDh/MwH.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: nnnnnn.barConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/VXPbNYFiF/Jx16a15jtbt4W7OEVSsQ/0Hchzr0JHqLXy5sSr3M/b_2FYv5OG1u0ccVDBhhzY1/uOFYOSZBHxbao/_2BXd3TX/Npdl9BTS8FA7o_2BWqGmh8W/GcITN_2B9v/zQpOaIZ_2FyM_2FHD/HIrNyvAnOpvv/7fGmjVEMNNv/tsw6xWgAX1_2FQ/_2B4GrQQmQexhaks5LfBR/44D9BrVgAaGviQmA/WTPToDpdiNvkPou/yqUxTArWqVDFn_2Fve/_2Bpr1G.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: nnnnnn.barConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /drew/VXPbNYFiF/Jx16a15jtbt4W7OEVSsQ/0Hchzr0JHqLXy5sSr3M/b_2FYv5OG1u0ccVDBhhzY1/uOFYOSZBHxbao/_2BXd3TX/Npdl9BTS8FA7o_2BWqGmh8W/GcITN_2B9v/zQpOaIZ_2FyM_2FHD/HIrNyvAnOpvv/7fGmjVEMNNv/tsw6xWgAX1_2FQ/_2B4GrQQmQexhaks5LfBR/44D9BrVgAaGviQmA/WTPToDpdiNvkPou/yqUxTArWqVDFn_2Fve/_2Bpr1G.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.nnnnnn.bar
Source: global traffic HTTP traffic detected: GET /drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXKRWnS/sNuzGwvgFbGuiX/cYwNdjWOtQd_2Fg50Gq6_/2FjOiJCVbSj9xwyh/G_2BXTVzOZQxb5p/q_2BNRYwk1baG5TnLz/jbdiar_2B/vITHroP6B_2F_2BAIZUm/KtOtUG2G23eAdJDsUmd/Q0nO6sNJelOrTMnHEyXMkV/0ho4YTGcPihXz/P5SVPgNqDh/MwH.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.nnnnnn.bar

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.307551422.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307614167.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300679083.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.785600191.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307578726.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.544816748.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.785050851.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307644069.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321771738.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.605390761.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321906680.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300868443.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.782849052.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307704201.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300896192.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321827168.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305308572.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300782095.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321800955.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321850861.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305489439.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321871746.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300925678.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305473167.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.784577185.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300831034.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.465850136.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307685619.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305361386.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.451028558.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307667358.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307723093.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321736735.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321892748.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300637854.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305444039.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305503274.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305414104.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300915509.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305391227.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loaddll32.exe PID: 4956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5848, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1860, type: MEMORYSTR

E-Banking Fraud
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.307551422.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307614167.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300679083.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.785600191.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307578726.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.544816748.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.785050851.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307644069.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321771738.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.605390761.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321906680.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300868443.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.782849052.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307704201.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300896192.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321827168.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305308572.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300782095.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321800955.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321850861.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305489439.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321871746.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300925678.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305473167.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.784577185.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300831034.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.465850136.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307685619.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305361386.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.451028558.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307667358.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307723093.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321736735.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321892748.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300637854.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305444039.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305503274.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305414104.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300915509.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305391227.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loaddll32.exe PID: 4956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5848, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1860, type: MEMORYSTR
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B74872 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 0_2_00B74872
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E4872 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 4_2_046E4872
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C74872 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError, 5_2_00C74872

System Summary
barindex
Writes or reads registry keys via WMI
Source: C:\Windows\System32\loaddll32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Writes registry values via WMI
Source: C:\Windows\System32\loaddll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Uses 32bit PE files
Source: 41e0000.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Detected potential crypto function
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10002244 0_2_10002244
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B74EF3 0_2_00B74EF3
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B76C62 0_2_00B76C62
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B781DC 0_2_00B781DC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E6C62 4_2_046E6C62
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E4EF3 4_2_046E4EF3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E81DC 4_2_046E81DC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C74EF3 5_2_00C74EF3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C76C62 5_2_00C76C62
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C781DC 5_2_00C781DC
Contains functionality to call native functions
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_100012BE NtMapViewOfSection, 0_2_100012BE
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001F61 GetProcAddress,NtCreateSection,memset, 0_2_10001F61
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001077 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError, 0_2_10001077
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10002465 NtQueryVirtualMemory, 0_2_10002465
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B777BB NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 0_2_00B777BB
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B78401 NtQueryVirtualMemory, 0_2_00B78401
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E77BB NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 4_2_046E77BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E8401 NtQueryVirtualMemory, 4_2_046E8401
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C777BB NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 5_2_00C777BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C78401 NtQueryVirtualMemory, 5_2_00C78401
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: 41e0000.dll ReversingLabs: Detection: 46%
Source: 41e0000.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\41e0000.dll"
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\41e0000.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\41e0000.dll
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\41e0000.dll",#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\41e0000.dll,DllRegisterServer
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6712 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3520 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3520 CREDAT:17414 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:17424 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:82948 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5396 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5696 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5696 CREDAT:82948 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5696 CREDAT:17422 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6300 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\41e0000.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\41e0000.dll Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\41e0000.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\41e0000.dll",#1 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6712 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3520 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3520 CREDAT:17414 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:17424 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:82948 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5396 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5696 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5696 CREDAT:82948 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5696 CREDAT:17422 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6300 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DF65E4B6-7A32-11EC-90E5-ECF4BB570DC9}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF48BD7061296EE036.TMP Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winDLL@37/72@48/9
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B72AB4 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 0_2_00B72AB4
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\41e0000.dll",#1
Source: C:\Windows\System32\loaddll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\loaddll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\loaddll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Data Obfuscation
barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10002233 push ecx; ret 0_2_10002243
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_100021E0 push ecx; ret 0_2_100021E9
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B77DE0 push ecx; ret 0_2_00B77DE9
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B781CB push ecx; ret 0_2_00B781DB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E7DE0 push ecx; ret 4_2_046E7DE9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_046E81CB push ecx; ret 4_2_046E81DB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C781CB push ecx; ret 5_2_00C781DB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 5_2_00C77DE0 push ecx; ret 5_2_00C77DE9
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001BE8 LoadLibraryA,GetProcAddress, 0_2_10001BE8
Registers a DLL
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\41e0000.dll

Hooking and other Techniques for Hiding and Protection
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.307551422.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307614167.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300679083.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.785600191.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307578726.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.544816748.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.785050851.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307644069.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321771738.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.605390761.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321906680.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300868443.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.782849052.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307704201.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300896192.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321827168.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305308572.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300782095.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321800955.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321850861.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305489439.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321871746.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300925678.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305473167.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.784577185.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300831034.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.465850136.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307685619.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305361386.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.451028558.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307667358.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307723093.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321736735.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321892748.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300637854.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305444039.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305503274.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305414104.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300915509.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305391227.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loaddll32.exe PID: 4956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5848, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1860, type: MEMORYSTR
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\loaddll32.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking system information)
Source: C:\Windows\System32\loaddll32.exe Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 7096 Thread sleep time: -1773297476s >= -30000s Jump to behavior
Found evasive API chain checking for process token information
Source: C:\Windows\SysWOW64\rundll32.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\loaddll32.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: regsvr32.exe, 00000003.00000002.783677906.0000000002D79000.00000004.00000020.sdmp, regsvr32.exe, 00000003.00000003.777130443.0000000002D79000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000003.605295288.0000000002D79000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000002.783462582.0000000002D48000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.782056278.0000000000B23000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.781731263.0000000000B00000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000003.594707637.0000000000B1A000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000003.562280336.0000000000B23000.00000004.00000001.sdmp, rundll32.exe, 00000005.00000003.766366477.0000000000B23000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000005.00000002.781731263.0000000000B00000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW'
Source: rundll32.exe, 00000005.00000003.545416357.0000000000B23000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: regsvr32.exe, 00000003.00000003.559541248.0000000002D7B000.00000004.00000001.sdmp, regsvr32.exe, 00000003.00000003.558838390.0000000002D79000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging
barindex
Found API chain indicative of debugger detection
Source: C:\Windows\System32\loaddll32.exe Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001BE8 LoadLibraryA,GetProcAddress, 0_2_10001BE8

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 198.54.117.217 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 198.54.117.218 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: museumistat.bar
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: www.nnnnnn.casa
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 162.255.119.177 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: nnnnnn.casa
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: www.nnnnnn.bar
Source: C:\Windows\SysWOW64\regsvr32.exe Domain query: nnnnnn.bar
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 192.64.119.233 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 198.54.117.216 80 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\41e0000.dll",#1 Jump to behavior
Source: loaddll32.exe, 00000000.00000002.783123426.0000000001A90000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.783996204.0000000003190000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.783663512.0000000002CB0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.784934992.0000000003040000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.783123426.0000000001A90000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.783996204.0000000003190000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.783663512.0000000002CB0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.784934992.0000000003040000.00000002.00020000.sdmp Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.783123426.0000000001A90000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.783996204.0000000003190000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.783663512.0000000002CB0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.784934992.0000000003040000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.783123426.0000000001A90000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.783996204.0000000003190000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.783663512.0000000002CB0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.784934992.0000000003040000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.783123426.0000000001A90000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.783996204.0000000003190000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.783663512.0000000002CB0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.784934992.0000000003040000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection
barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B721BC cpuid 0_2_00B721BC
Source: C:\Windows\System32\loaddll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_10001DCF GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError, 0_2_10001DCF
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_1000169C CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError, 0_2_1000169C
Source: C:\Windows\System32\loaddll32.exe Code function: 0_2_00B721BC RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree, 0_2_00B721BC

Stealing of Sensitive Information
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.307551422.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307614167.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300679083.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.785600191.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307578726.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.544816748.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.785050851.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307644069.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321771738.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.605390761.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321906680.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300868443.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.782849052.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307704201.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300896192.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321827168.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305308572.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300782095.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321800955.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321850861.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305489439.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321871746.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300925678.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305473167.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.784577185.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300831034.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.465850136.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307685619.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305361386.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.451028558.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307667358.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307723093.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321736735.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321892748.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300637854.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305444039.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305503274.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305414104.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300915509.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305391227.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loaddll32.exe PID: 4956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5848, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1860, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.307551422.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307614167.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300679083.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.785600191.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307578726.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.544816748.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.785050851.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307644069.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321771738.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.605390761.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321906680.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300868443.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.782849052.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307704201.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300896192.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321827168.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305308572.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300782095.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321800955.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321850861.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305489439.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321871746.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300925678.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305473167.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.784577185.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300831034.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.465850136.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307685619.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305361386.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.451028558.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307667358.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.307723093.0000000004F68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321736735.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.321892748.0000000004C78000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300637854.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305444039.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305503274.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305414104.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.300915509.0000000005048000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.305391227.00000000016E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loaddll32.exe PID: 4956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 5792, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5848, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1860, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 556767 Sample: 41e0000.dll Startdate: 20/01/2022 Architecture: WINDOWS Score: 100 42 www.nnnnnn.bar 2->42 44 nnnnnn.bar 2->44 46 parkingpage.namecheap.com 2->46 76 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->76 78 Multi AV Scanner detection for domain / URL 2->78 80 Found malware configuration 2->80 82 6 other signatures 2->82 8 loaddll32.exe 7 2->8         started        12 iexplore.exe 2->12         started        14 iexplore.exe 2->14         started        16 4 other processes 2->16 signatures3 process4 dnsIp5 70 www.nnnnnn.casa 8->70 72 www.nnnnnn.bar 8->72 74 4 other IPs or domains 8->74 94 Found evasive API chain (may stop execution after checking system information) 8->94 96 Found API chain indicative of debugger detection 8->96 98 Writes or reads registry keys via WMI 8->98 100 Writes registry values via WMI 8->100 18 regsvr32.exe 6 8->18         started        22 cmd.exe 1 8->22         started        24 rundll32.exe 6 8->24         started        32 3 other processes 12->32 34 3 other processes 14->34 26 iexplore.exe 31 16->26         started        28 iexplore.exe 31 16->28         started        30 iexplore.exe 16->30         started        36 2 other processes 16->36 signatures6 process7 dnsIp8 50 3 other IPs or domains 18->50 84 System process connects to network (likely due to code injection or exploit) 18->84 86 Writes or reads registry keys via WMI 18->86 88 Writes registry values via WMI 18->88 38 rundll32.exe 6 22->38         started        52 4 other IPs or domains 24->52 48 museumistat.bar 26->48 54 3 other IPs or domains 28->54 56 2 other IPs or domains 30->56 58 3 other IPs or domains 32->58 60 5 other IPs or domains 34->60 62 4 other IPs or domains 36->62 signatures9 process10 dnsIp11 64 www.nnnnnn.casa 38->64 66 nnnnnn.casa 38->66 68 2 other IPs or domains 38->68 90 System process connects to network (likely due to code injection or exploit) 38->90 92 Writes registry values via WMI 38->92 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.54.117.217
 unknown United States
22612 NAMECHEAP-NETUS true
198.54.117.218
 unknown United States
22612 NAMECHEAP-NETUS true
198.54.117.210
 unknown United States
22612 NAMECHEAP-NETUS true
198.54.117.211
 unknown United States
22612 NAMECHEAP-NETUS true
192.64.119.233
 nnnnnn.casa United States
22612 NAMECHEAP-NETUS true
162.255.119.177
 nnnnnn.bar United States
22612 NAMECHEAP-NETUS true
198.54.117.215
 unknown United States
22612 NAMECHEAP-NETUS true
198.54.117.216
 parkingpage.namecheap.com United States
22612 NAMECHEAP-NETUS false

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
parkingpage.namecheap.com 198.54.117.216 true
nnnnnn.bar 162.255.119.177 true
nnnnnn.casa 192.64.119.233 true
museumistat.bar unknown unknown
www.nnnnnn.casa unknown unknown
www.nnnnnn.bar unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.nnnnnn.casa/drew/gKT0MlKWG38_2/BMau4Oul/cEXy48BAqFiRWaKy3Hmuv38/3RbGiyCyh2/l1GuJ4tJh6rYVcx3P/CJUEexxeLegN/asUAVrcr8Os/6Heu8XQ9NwKS3r/RsXyOEKXh6_2Fk8FF_2Be/55GNIEO4rqxc9s7n/ukqCx_2FTaQH3qL/wkmTl5GH5xOHOuPfEe/BWDc8XF7Q/Aj_2BpbOenr9CVTaE_2B/XdQQRARWLLAVNpj0F5Y/DhKfHWf2CN42/6CU_2FsM/oq0.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.casa/drew/aO1m2qbhzR/PyScSysfUMu7pQ56N/VjOvZCjAa_2F/1mYmXVIR1Zt/ZytsC9Ykmf_2Fu/iu9BdbHsH649dhw5xv4AE/uvJRR2pHSfmCL3mX/qVeQLGXMe6qLR0u/Wt56BLAa0ngbKPNWJl/aK0_2FM_2/B_2FgePTZg5J6aAm67BS/UxRCj8tcca1XehAjtUd/YhkFvH3YtE1Pt1_2BwmyD7/71NTX8ZhkOA2A/ekCIE_2B/Axlx1Zu2c2Fm5fnQIZEKkDy/m.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.casa/drew/MeZUUlMrrzCrTTo/WRQsq4b7fIDR_2F2ui/K6Zod5HZQ/pReKsZQJuAIiqXNhcotr/27SAvb0lLGD4m4MtFqv/lionnkJutjVCo9Od2amHc6/vcomrgcHuTiyu/619f5X9g/OqezXl3127vZEQSYuxkxeXa/jXToImScJb/S5cz6j_2Fse9g4BcM/g7zL04pozIiS/_2B_2FN5VMo/ZAlJdIbg2SlHI1/d8no93Q9ma7mUN4PubD3o/tloZKX2Kmj/q.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.bar/drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2/qg8dX3i_2/BKHu1GhglPcxgFFzOwll/mE2uKWB4mhjJIhyxTbk/_2F4mS5i039Fc7Qu_2Bekr/iQMweYWStlPtj/o4jxWrxk/qxdFPQJxNpwFwYEvbalIklB/QVqGaFPam2/C2rQw2gzAO6yhP_2F/dkOEushjYAis/iro3PbyNh/HGAz2Q_2F/i0Bn.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.bar/drew/2dHt0g0ZqxBpcdpMURTYE/SQxrvbTaCVQCWrs7/t263S3GMZiTKRdq/jvCj142v8i06uAQqd2/qg8dX3i_2/BKHu1GhglPcxgFFzOwll/mE2uKWB4mhjJIhyxTbk/_2F4mS5i039Fc7Qu_2Bekr/iQMweYWStlPtj/o4jxWrxk/qxdFPQJxNpwFwYEvbalIklB/QVqGaFPam2/C2rQw2gzAO6yhP_2F/dkOEushjYAis/iro3PbyNh/HGAz2Q_2F/i0Bn.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.bar/drew/BVo0JfnyET/LCuKNvyhPvtrfvUnc/mObdgwXcgrZe/zSKG23eDqpN/HkpkBNiTxuWbBP/jak_2BPpM4WA8X4iaERBU/M_2BNnZd3vNVKd3D/snYYJ6wnfiJDJcL/92irgYdy9jdt7bObTQ/XthL2dpz7/ChmMUV7DDxy9eem0RAqA/QIh0WdqUZEhxu0X9j_2/F2lcfFWCQ7qV66laejvuEP/BvotBkMbOhSl5/Azm9mu3j/3M1GGyFrveB8gl1/M.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.casa/drew/MeZUUlMrrzCrTTo/WRQsq4b7fIDR_2F2ui/K6Zod5HZQ/pReKsZQJuAIiqXNhcotr/27SAvb0lLGD4m4MtFqv/lionnkJutjVCo9Od2amHc6/vcomrgcHuTiyu/619f5X9g/OqezXl3127vZEQSYuxkxeXa/jXToImScJb/S5cz6j_2Fse9g4BcM/g7zL04pozIiS/_2B_2FN5VMo/ZAlJdIbg2SlHI1/d8no93Q9ma7mUN4PubD3o/tloZKX2Kmj/q.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.casa/drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/SDWuXQsskkRv/UNsc0mp28hP/x_2B_2FFq_2BHQ/F27_2FxKayrB3Cjy97Qhx/v8nlOT4QFPkzm4Ie/eAXoVlzzaxz8tgI/QR3P1Uk2I7ZbwimQXR/OfOcdTcUh/zjDQ5XVxR1cI0bdt8PDF/mZjcYY9L2vv_2BELjHj/Y7ijGd_2F3psmxh_2FsXvv/mj29lZ4n/h.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.bar/drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0O8/4fSjQKFRypPXeHUM/2VwdsjoRmoerb1g/N6r4i0t9F_2FA66_2F/CrVcoXDX5/D2kSFR1VHNVLT3GtdrVC/2IzirCs34EDnFYvNPWY/fYM6gayTm5L9yWZL2Vx5Nc/R0anH3ZYvesfP/30v94E34/TL40v70SibYCobhKHsZEJ7c/OLRlO.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.bar/drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.casa/drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8dXb3jJiK/zds9L6K3nZZ7oSB_2FRe/J_2F81pI4nTjSy_2FLT/d8Gf2VlN_2BGJ3KTHQhxNU/PK1lsXUZsV6B7/COUqQ3wX/120xfpxJZhcCTcDgyQOQ47a/2BRczUrfQU/ppPj1HI3Q0OhFDCjv/4_2Br67LS5pR/l5aWeKuI6uG/ni53ezQ1izt/Yu.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.casa/drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzSdCW3EjFkfnBVLNrh/u6iSfeXnIxEc4/iOpnKu8_/2B6ER0J96Uzbim1bUMtmrJq/DMYICZNGt5/BH1k0iCPsGbgr2jmq/LZISYUDUDQ3s/sBmfD_2B_2F/KeRIfCDg82xxJ1/5QkNXVsBvP5NPb2r4nyOG/rCLwK7C8JPaslI4x/C4pqB4g_2/B.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.casa/drew/dRBCohQjpH2R4ZrxcN/VH3wq9yT2/VmLml8GJ5aPaDzoCDj8x/EmzpTBuP5mftF8uNtQM/TnqYzSdCW3EjFkfnBVLNrh/u6iSfeXnIxEc4/iOpnKu8_/2B6ER0J96Uzbim1bUMtmrJq/DMYICZNGt5/BH1k0iCPsGbgr2jmq/LZISYUDUDQ3s/sBmfD_2B_2F/KeRIfCDg82xxJ1/5QkNXVsBvP5NPb2r4nyOG/rCLwK7C8JPaslI4x/C4pqB4g_2/B.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.casa/drew/0j7ZvX6Yf_2Ff4PZOIhk8/4LwtJMzbxxuFilPr/sSF9SqjkHo3YN93/N6KmwTforklWI7En4U/8dXb3jJiK/zds9L6K3nZZ7oSB_2FRe/J_2F81pI4nTjSy_2FLT/d8Gf2VlN_2BGJ3KTHQhxNU/PK1lsXUZsV6B7/COUqQ3wX/120xfpxJZhcCTcDgyQOQ47a/2BRczUrfQU/ppPj1HI3Q0OhFDCjv/4_2Br67LS5pR/l5aWeKuI6uG/ni53ezQ1izt/Yu.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.casa/drew/ryTDvI_2B04X_/2F0aCkH0/_2BDKJR7A0jigzDfk2oUtkS/TzWw2n73nE/Dg4sUCgqU_2FAr5Pj/SDWuXQsskkRv/UNsc0mp28hP/x_2B_2FFq_2BHQ/F27_2FxKayrB3Cjy97Qhx/v8nlOT4QFPkzm4Ie/eAXoVlzzaxz8tgI/QR3P1Uk2I7ZbwimQXR/OfOcdTcUh/zjDQ5XVxR1cI0bdt8PDF/mZjcYY9L2vv_2BELjHj/Y7ijGd_2F3psmxh_2FsXvv/mj29lZ4n/h.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.bar/drew/BVo0JfnyET/LCuKNvyhPvtrfvUnc/mObdgwXcgrZe/zSKG23eDqpN/HkpkBNiTxuWbBP/jak_2BPpM4WA8X4iaERBU/M_2BNnZd3vNVKd3D/snYYJ6wnfiJDJcL/92irgYdy9jdt7bObTQ/XthL2dpz7/ChmMUV7DDxy9eem0RAqA/QIh0WdqUZEhxu0X9j_2/F2lcfFWCQ7qV66laejvuEP/BvotBkMbOhSl5/Azm9mu3j/3M1GGyFrveB8gl1/M.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.bar/drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughemPo02ekn/fOGpqXigagMOIeoi2whU2K/VcKgvpNbHoVGC/D5UC9izH/aHNIhYwGohjos0FQ6xviFWf/oAZv_2Bi_2/FQiT5Hhg78q185o5l/RS9K9tlnC9cl/irJKo_2Bc3F/Cv7H0DN6I4ItJ9/fG_2BK5HpVFIp2pJnaZ2D/aV8ATJwwcAP/_2Bs.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.bar/drew/b2eob5aE7jJqRFK/rA9TqIOSBzTkqwZ1zv/iNhLsTUKi/a_2FZiiuvYhXdLNrvbCh/8PEJcafughemPo02ekn/fOGpqXigagMOIeoi2whU2K/VcKgvpNbHoVGC/D5UC9izH/aHNIhYwGohjos0FQ6xviFWf/oAZv_2Bi_2/FQiT5Hhg78q185o5l/RS9K9tlnC9cl/irJKo_2Bc3F/Cv7H0DN6I4ItJ9/fG_2BK5HpVFIp2pJnaZ2D/aV8ATJwwcAP/_2Bs.jlk true
  • Avira URL Cloud: malware
 unknown
http://www.nnnnnn.bar/drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXKRWnS/sNuzGwvgFbGuiX/cYwNdjWOtQd_2Fg50Gq6_/2FjOiJCVbSj9xwyh/G_2BXTVzOZQxb5p/q_2BNRYwk1baG5TnLz/jbdiar_2B/vITHroP6B_2F_2BAIZUm/KtOtUG2G23eAdJDsUmd/Q0nO6sNJelOrTMnHEyXMkV/0ho4YTGcPihXz/P5SVPgNqDh/MwH.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.casa/drew/gKT0MlKWG38_2/BMau4Oul/cEXy48BAqFiRWaKy3Hmuv38/3RbGiyCyh2/l1GuJ4tJh6rYVcx3P/CJUEexxeLegN/asUAVrcr8Os/6Heu8XQ9NwKS3r/RsXyOEKXh6_2Fk8FF_2Be/55GNIEO4rqxc9s7n/ukqCx_2FTaQH3qL/wkmTl5GH5xOHOuPfEe/BWDc8XF7Q/Aj_2BpbOenr9CVTaE_2B/XdQQRARWLLAVNpj0F5Y/DhKfHWf2CN42/6CU_2FsM/oq0.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.bar/drew/6ktn4xRUX5JQALxIWi_2FJ/ICUDlvTaNKSMK/d1ei2DU0/YfFfMIO56w8ZRW_2Fc4zkGn/yDjRWn9P_2/BB0g0D98WIpaFL2hK/UQH6jhZN2tpm/ORHiRY8gQ2t/UYqiaMMUPs7I05/R0awjzx8aAAERc7YB4ys0/Q5QjXt_2F1mCoLne/245MRunYvrY5c2x/MdnxTtnmOaN2uVZew3/1GHuZOvuL/Rb_2Bfqw7L_2BYB_2FWD/UIZ_2FNd7aPjE9V_2B_/2BC4BHu.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.casa/drew/aO1m2qbhzR/PyScSysfUMu7pQ56N/VjOvZCjAa_2F/1mYmXVIR1Zt/ZytsC9Ykmf_2Fu/iu9BdbHsH649dhw5xv4AE/uvJRR2pHSfmCL3mX/qVeQLGXMe6qLR0u/Wt56BLAa0ngbKPNWJl/aK0_2FM_2/B_2FgePTZg5J6aAm67BS/UxRCj8tcca1XehAjtUd/YhkFvH3YtE1Pt1_2BwmyD7/71NTX8ZhkOA2A/ekCIE_2B/Axlx1Zu2c2Fm5fnQIZEKkDy/m.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.bar/drew/aOCcLYeYaTiAEXOHR/rDcm23Ra7HRA/Ll0tIfgTYdg/Ovc937_2BZJhqR/_2B9nyoyx5GXZFgCkf0O8/4fSjQKFRypPXeHUM/2VwdsjoRmoerb1g/N6r4i0t9F_2FA66_2F/CrVcoXDX5/D2kSFR1VHNVLT3GtdrVC/2IzirCs34EDnFYvNPWY/fYM6gayTm5L9yWZL2Vx5Nc/R0anH3ZYvesfP/30v94E34/TL40v70SibYCobhKHsZEJ7c/OLRlO.jlk true
  • Avira URL Cloud: malware
 unknown
http://nnnnnn.bar/drew/zBWev8_2BKC0Kv4cFyjxa4K/cXf7Mx9Yu7/tb380Z5Te_2FUr5sc/S5LVwKU9d2Ii/UAurGXKRWnS/sNuzGwvgFbGuiX/cYwNdjWOtQd_2Fg50Gq6_/2FjOiJCVbSj9xwyh/G_2BXTVzOZQxb5p/q_2BNRYwk1baG5TnLz/jbdiar_2B/vITHroP6B_2F_2BAIZUm/KtOtUG2G23eAdJDsUmd/Q0nO6sNJelOrTMnHEyXMkV/0ho4YTGcPihXz/P5SVPgNqDh/MwH.jlk true
  • Avira URL Cloud: malware
 unknown