Windows Analysis Report
zPJUOck9wt.exe

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6336:120:WilError_03

Source: zPJUOck9wt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: zPJUOck9wt.exe	ReversingLabs: Detection: 34%
Source: zPJUOck9wt.exe	Virustotal: Detection: 48%

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

File read: C:\Users\user\Desktop\zPJUOck9wt.exe

Source: unknown	Process created: C:\Users\user\Desktop\zPJUOck9wt.exe "C:\Users\user\Desktop\zPJUOck9wt.exe"
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\Update.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\Update.exe C:\Users\Public\Bilite\Axialis\Update.exe
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\Update.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\Update.exe C:\Users\Public\Bilite\Axialis\Update.exe	Jump to behavior

Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: update.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Source: install_flash_player_ppapi.exe.lnk.3.dr

LNK file: ..\..\Public\Bilite\install_flash_player_ppapi.exe

Source: zPJUOck9wt.exe

Static file information: File size 21615909 > 1048576

Source:	Binary string: \YSS\Release\Update.pdb source: zPJUOck9wt.exe, 00000000.00000003.1688917721.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000003.00000002.1696407461.000000006C9DB000.00000002.00000001.01000000.00000006.sdmp, Update.dll.0.dr
Source:	Binary string: Morpheme.pdb source: zPJUOck9wt.exe, 00000000.00000003.1688917721.0000000002DA8000.00000004.00000020.00020000.00000000.sdmp, install_flash_player_ppapi.exe.0.dr
Source:	Binary string: E:\agent\workspace\p-e3cf6c00cb1d4f41832c02872427999a\src\Ufo4WinMac\GamerUFO\ufo4Desktop\Output\bin\Release\UpdateApp.pdb source: zPJUOck9wt.exe, 00000000.00000003.1688917721.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000003.00000000.1692112652.0000000000852000.00000002.00000001.01000000.00000005.sdmp, Update.exe, 00000003.00000002.1695714101.0000000000852000.00000002.00000001.01000000.00000005.sdmp, Update.exe.0.dr
Source:	Binary string: E:\agent\workspace\p-e3cf6c00cb1d4f41832c02872427999a\src\Ufo4WinMac\GamerUFO\ufo4Desktop\Output\bin\Release\UpdateApp.pdb((& source: zPJUOck9wt.exe, 00000000.00000003.1688917721.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000003.00000000.1692112652.0000000000852000.00000002.00000001.01000000.00000005.sdmp, Update.exe, 00000003.00000002.1695714101.0000000000852000.00000002.00000001.01000000.00000005.sdmp, Update.exe.0.dr

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Code function: 0_2_00411C20 push eax; ret		0_2_00411C4E
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C99FA5C push ecx; ret		3_2_6C99FA6F

Source: C:\Users\user\Desktop\zPJUOck9wt.exe	File created: C:\Users\Public\Bilite\Axialis\Update.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	File created: C:\Users\Public\Bilite\Axialis\Update.exe	Jump to dropped file
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	File created: C:\Users\Public\Bilite\install_flash_player_ppapi.exe	Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C8668AC IsIconic,	3_2_6C8668AC
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C8699DC IsWindowVisible,IsIconic,	3_2_6C8699DC
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C885ACD GetParent,IsIconic,GetParent,	3_2_6C885ACD
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C86F4BA SendMessageW,IsIconic,IsWindowVisible,	3_2_6C86F4BA
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C897012 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	3_2_6C897012

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

Dropped PE file which has not been started: C:\Users\Public\Bilite\install_flash_player_ppapi.exe

Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Evaded block: after key decision

graph_3-62444

Source: C:\Users\Public\Bilite\Axialis\Update.exe

API coverage: 4.8 %

Source: C:\Users\Public\Bilite\Axialis\Update.exe TID: 3848

Thread sleep time: -73000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Code function: 0_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	0_2_0040301A
Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Code function: 0_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402B79
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C88EB8C __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,	3_2_6C88EB8C

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Thread delayed: delay time: 73000

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Code function: 3_2_008515D0 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_008515D0

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_00851A8F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00851A8F
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_008515D0 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_008515D0
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_00851764 SetUnhandledExceptionFilter,	3_2_00851764
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C9AA83C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C9AA83C
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C9A060D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C9A060D
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6C99FE55 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C99FE55

Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\Update.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\Update.exe C:\Users\Public\Bilite\Axialis\Update.exe			Jump to behavior

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

Code function: 0_2_0040D72E cpuid

0_2_0040D72E

Source: C:\Users\user\Desktop\zPJUOck9wt.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,	0_2_00401F9D
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,	3_2_6C9C6DC7
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoW,	3_2_6C87EDE4
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: EnumSystemLocalesW,	3_2_6C9C6EB9
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: EnumSystemLocalesW,	3_2_6C9C6E6E
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_6C9C6FDF
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: EnumSystemLocalesW,	3_2_6C9C6F54
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,	3_2_6C9BC911
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_6C9C6BC2
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: EnumSystemLocalesW,	3_2_6C9BC3A5
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,	3_2_6C9C7461
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_6C9C7537
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,	3_2_6C9C7232
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_6C9C735B

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

Code function: 0_2_00401626 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_00401626

Source: C:\Users\user\Desktop\zPJUOck9wt.exe

Code function: 0_2_00404FAA GetVersionExW,GetCommandLineW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,memset,ShellExecuteExW,WaitForSingleObject,CloseHandle,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

0_2_00404FAA

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	21 Input Capture	1 System Time Discovery	Remote Services	21 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	35 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zPJUOck9wt.exe	35%	ReversingLabs	Win32.Dropper.Vilsel
zPJUOck9wt.exe	49%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Bilite\Axialis\Update.dll	48%	ReversingLabs	Win32.Trojan.Generic
C:\Users\Public\Bilite\Axialis\Update.exe	0%	ReversingLabs
C:\Users\Public\Bilite\install_flash_player_ppapi.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_install_	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	zPJUOck9wt.exe	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	zPJUOck9wt.exe	false		high
https://sectigo.com/CPS0	zPJUOck9wt.exe	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	zPJUOck9wt.exe	false		high
https://://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_install_	zPJUOck9wt.exe, 00000000.00000003.1688917721.0000000002DA8000.00000004.00000020.00020000.00000000.sdmp, install_flash_player_ppapi.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	zPJUOck9wt.exe	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	zPJUOck9wt.exe	false		high
http://ocsp.sectigo.com0	zPJUOck9wt.exe	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	zPJUOck9wt.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581726
Start date and time:	2024-12-28 20:56:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zPJUOck9wt.exe renamed because original name is a hash value
Original Sample Name:	1bf851229cdc8a1b97523ed4fa48b977.exe
Detection:	MAL
Classification:	mal60.winEXE@6/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 84 Number of non-executed functions: 352
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:57:02	API Interceptor	1x Sleep call for process: Update.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\Public\Bilite\Axialis\Update.exe	MEuu1a2o6n.exe	Get hash	malicious	GhostRat	Browse
C:\Users\Public\Bilite\Axialis\Update.exe	MEuu1a2o6n.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Bilite\Axialis\IiViS

Process:	C:\Users\user\Desktop\zPJUOck9wt.exe
File Type:	openssl enc'd data with salted password, base64 encoded
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.265319531114784
Encrypted:	false
SSDEEP:	3:iqkdd0LEgncgVjfkbRn:ilfwBctn
MD5:	E6A32CA4BF503C5CA8A78E2F5472A4DF
SHA1:	5D3E6DF8AA7FA052F7CB212B08A1801C5A6561B1
SHA-256:	D23108539C9A78F5FBC141FB1AE2A980967E188BF693DFF1055F83028D29833D
SHA-512:	0E39657A57D3813FB441EB1FB5280AF573CE717D13178FAEC2F4B4DFBD605BEA5658A6A35FFB29B2EDA9BB0F7D24EE51286A66E509A1A9CD8ADBE2514C4CEB93
Malicious:	false
Reputation:	low
Preview:	U2FsdGVkX19I8ZtoqW93Fj6yeovix5itQRtgLoSHjApm80LQ/4FyDlKt1AiPVRRD

C:\Users\Public\Bilite\Axialis\Update.dll

Process:	C:\Users\user\Desktop\zPJUOck9wt.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2214912
Entropy (8bit):	6.635782448765808
Encrypted:	false
SSDEEP:	49152:6WProiAXfi2iG9bcEaU0yl0bZU4yBhQV2bYQKabQQ4o5gnKqxSpkDUC:6WPrZAXfPiG9bKU0FlU4ybpPKabQg5gD
MD5:	9939E9DDC47F7DC405A107DC882126E3
SHA1:	2EF13A0ECC77F7FA6578FC04D8F913759808881D
SHA-256:	037929DF4F79A5060FDB189A9248C22A926D937018E52FB8BA36FA2AFB05404C
SHA-512:	753FBBC04C52391C0815D94BB101FF585DD72FF643CDA09BF0F72ADC80AB667ADB9F19299357743B1905DE38EB9D75D4D2BD30E7AC57F9DF7E1DBDA782B3AF81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 48%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3i{.R.(.R.(.R.(..).R.(..).R.(..)wR.(..).R.(..).R.(.R.(.Q.(...).R.(...).R.(...)&S.( ..).R.( ..).R.( ..(.R.( ..).R.(Rich.R.(........................PE..L...B.kg...........!........2......+........................................@"...........@.............................P.......h........H.................... .0....8..p....................9.......7..@............................................text.............................. ..`.rdata..p].......^..................@..@.data...........\..................@....rsrc....H.......H...T..............@..@.reloc..0..... ..0..................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Axialis\Update.exe

Process:	C:\Users\user\Desktop\zPJUOck9wt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	395368
Entropy (8bit):	5.090673225697451
Encrypted:	false
SSDEEP:	6144:I0acLF3rgypB1Grf/TRfiJ7BePaEvLJggZy:Y/TRfi3ePtJRg
MD5:	FB325C945A08D06FE91681179BDCCC66
SHA1:	F5D91B7D75D34E156066AB4099E0FD0DF9227B32
SHA-256:	0C2CC4513EC9101A28A7988C72A46175EFD82F387BB3BCFB2612E808804282B5
SHA-512:	2BB588EBE2FA35D03652AEC4E5D51DABD3A24E996336A4D5EC9C762D6084862D5CD5F530F1DA0B98D2887BA88F4E077697D128071FF497D2967F9F42ADC2F533
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MEuu1a2o6n.exe, Detection: malicious, Browse Filename: MEuu1a2o6n.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:..[...[...[...#l..[.......[.......[.......[.......[..b....[..e....[...0...[...[...[..e....[..e....[...[h..[..e....[..Rich.[..........................PE..L...X..e............................\........ ....@..................................8....@.................................D(.......@..................h(...........!..T............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0.......$..............@....rsrc........@.......&..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\install_flash_player_ppapi.exe

Process:	C:\Users\user\Desktop\zPJUOck9wt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20846560
Entropy (8bit):	7.987627287733052
Encrypted:	false
SSDEEP:	393216:zaD7gW+8fh6K6SHC17vRtYHL6pvUBIl2vnhbGwxi:zEnwK6Si9vo6JUE41Gb
MD5:	3CBDCE6D8C779406AC208A16E4953D10
SHA1:	60A251BC7383443131C4C58DF9081B73009AA955
SHA-256:	6B0CC56214DBB2199DABF5CD7D60C6A07EF418342E9343EDCA12F8ABA1061A72
SHA-512:	7E76B71B5BF7DE40D0174AC8B73ED7EA3E7D957CEEE7989A655E48EE8AF56533D721195DB500200DA4BCAC3690921DF821E4C58EB2C92CC554CAFA40ECFA2383
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N...........W....W.E......F.....T......T..............W.......P.G.....G.....D......B....Rich...........................PE..L...8g.Z......................:...................@..........................@>.....Pj>...@.................................l........0....8...........=.......=..-.....................................@............................................text............................... ..`.rdata..............................@..@.data...$8..........................@....rsrc.....8..0....8.................@..@.reloc..zA....=..B....=.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\install_flash_player_ppapi.exe.lnk

Process:	C:\Users\Public\Bilite\Axialis\Update.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Dec 28 18:56:59 2024, mtime=Sat Dec 28 18:57:01 2024, atime=Sun Jun 21 05:05:14 2020, length=20846560, window=hide
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	4.7331574952283155
Encrypted:	false
SSDEEP:	12:82NOUlGI7iCICHqXmm2sX/lv3ACmqmcAD7zwHl/QY2ojAb0ncG/Y2zavbMg44t2W:8UGIq23ukND+l/+sAb0J2vAfqyFm
MD5:	369507171E30CE9B984DC58A9E71B9CD
SHA1:	C7B8D44EF036542C4CC50CB8C68AAA0EF87AC0E7
SHA-256:	C00BF21723B45F86FCD995159C8AAD60C3CF0A916352760D90500582CEF4CC74
SHA-512:	450F2087CA004E105F70F064C7BE507431229E2DB9516AE664B95B4F9C4E9E6E1FA36BC808C8B3405624F7CD45C53184AD8AEC64969EF726D3223830F15CE899
Malicious:	false
Reputation:	low
Preview:	L..................F.... ....v..bY..!.7.bY.....G....>..........................P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH.Y......................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......Y ...Public..f......O.I.Y".....+...............<.......P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....T.1......Y ...Bilite..>......Y ..Y .............................o.B.i.l.i.t.e.......2...>..P.0 .INSTAL~1.EXE..n......Y ..Y!...........................".#.i.n.s.t.a.l.l._.f.l.a.s.h._.p.l.a.y.e.r._.p.p.a.p.i...e.x.e.......d...............-.......c...........r..y.....C:\Users\Public\Bilite\install_flash_player_ppapi.exe..2.....\.....\.P.u.b.l.i.c.\.B.i.l.i.t.e.\.i.n.s.t.a.l.l._.f.l.a.s.h._.p.l.a.y.e.r._.p.p.a.p.i...e.x.e..........v..*.cM.jVD.Es.!...`.......X.......657773...........hT..CrF.f4... .j.T..b...,.......hT..CrF.f4... .j.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.998823108737483
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zPJUOck9wt.exe
File size:	21'615'909 bytes
MD5:	1bf851229cdc8a1b97523ed4fa48b977
SHA1:	037c0db18b290df45a54ff23556516b24206173d
SHA256:	ce6667acf10faea38244c15da512a68d09725f9e21bb5edc6b22d1048ddc552f
SHA512:	8e8aca3ccd5b9cde98255c2bf7fa95f75c9c3cb575c91e3304a7a90bb0a1ea0b98eacde725809c4b201288fb280045efd02518fc379a4322725cd5cdad32c2ce
SSDEEP:	393216:Hpd0SoUNyS1eey9cLBzAAua7MdTlBW9F9CxkmjjzomHA3YvwFBNZ3laN4z:JaSoiy19cduakTlQ9q2mjjzHgIvMBNZx
TLSH:	B22733C2F78467F4C2B2A1BAD9555BB38973CB42E6051988DE3949172F4A4F2810B1FF
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................................0....@..........................@...............................................P........................I..).

File Icon


Icon Hash:	01e0f2ccd4d4c400

Static PE Info

General

Entrypoint:	0x411def
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4C26F87E [Sun Jun 27 07:06:38 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b5a014d7eeb4c2042897567e1288a095

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	17/07/2022 20:00:00 17/07/2024 19:59:59
Subject Chain	CN=Incredibuild Software Ltd., O=Incredibuild Software Ltd., S=Tel Aviv, C=IL
Version:	3
Thumbprint MD5:	8164525B12F9B6829CCD5054865F2D41
Thumbprint SHA-1:	583F01EE72450A9945FB1CFA539BAAB983D3F1D9
Thumbprint SHA-256:	2EBD549CFBD28201F8773F370E920A21BB010F577BA74B4726332D2CE7836F69
Serial:	7098774ED29B0565AB114EF2F2871CF7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00414C50h
push 00411F80h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00413184h]
pop ecx
or dword ptr [00419924h], FFFFFFFFh
or dword ptr [00419928h], FFFFFFFFh
call dword ptr [00413188h]
mov ecx, dword ptr [0041791Ch]
mov dword ptr [eax], ecx
call dword ptr [0041318Ch]
mov ecx, dword ptr [00417918h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00413190h]
mov eax, dword ptr [eax]
mov dword ptr [00419920h], eax
call 00007F3618C59402h
cmp dword ptr [00417710h], ebx
jne 00007F3618C592EEh
push 00411F78h
call dword ptr [00413194h]
pop ecx
call 00007F3618C593D4h
push 00417048h
push 00417044h
call 00007F3618C593BFh
mov eax, dword ptr [00417914h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00417910h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041319Ch]
push 00417040h
push 00417000h
call 00007F3618C5938Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x150dc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x190d7	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x149ac0d	0x2918
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x310	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11317	0x11400	797279c5ab1a163aed1f2a528f9fe3ce	False	0.6174988677536232	data	6.576987441854239	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x30ea	0x3200	1359639b02bcb8f0a8743e6ead1c0030	False	0.43828125	data	5.549434098115495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x292c	0x800	9415c9c8dea3245d6d73c23393e27d8e	False	0.431640625	data	3.6583182363171756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a000	0x190d7	0x19200	aedf42f084dabb70902985d8cb8d4f42	False	0.14223802860696516	data	4.481844282645869	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a208	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.42819148936170215
RT_ICON	0x1a670	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.2767354596622889
RT_ICON	0x1b718	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Russian	Russia	0.2513485477178423
RT_ICON	0x1dcc0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Russian	Russia	0.17170524326877656
RT_ICON	0x21ee8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	Russian	Russia	0.09922512717378446
RT_GROUP_ICON	0x32710	0x4c	data	Russian	Russia	0.7763157894736842
RT_VERSION	0x3275c	0x350	data	English	United States	0.47523584905660377
RT_VERSION	0x32aac	0x3b0	data	Chinese	China	0.4523305084745763
RT_MANIFEST	0x32e5c	0x27b	ASCII text, with very long lines (635), with no line terminators	English	United States	0.5118110236220472

Imports

DLL	Import
COMCTL32.dll
KERNEL32.dll	GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, LoadLibraryA, LockResource, LoadResource, SizeofResource, FindResourceExA, MulDiv, GlobalFree, GlobalAlloc, lstrcmpiA, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, MultiByteToWideChar, GetLocaleInfoW, lstrlenA, lstrcmpiW, GetEnvironmentVariableW, lstrcmpW, GlobalMemoryStatusEx, VirtualAlloc, WideCharToMultiByte, ExpandEnvironmentStringsW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, SetThreadLocale, GetLocalTime, GetSystemTimeAsFileTime, lstrlenW, GetTempPathW, SetEnvironmentVariableW, CloseHandle, CreateFileW, GetDriveTypeW, SetCurrentDirectoryW, GetModuleFileNameW, GetCommandLineW, GetVersionExW, CreateEventW, SetEvent, ResetEvent, InitializeCriticalSection, TerminateThread, ResumeThread, SuspendThread, IsBadReadPtr, LocalFree, lstrcpyW, FormatMessageW, GetSystemDirectoryW, DeleteCriticalSection, GetFileSize, SetFilePointer, ReadFile, SetFileTime, SetEndOfFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleHandleA, SystemTimeToFileTime, GetLastError, CreateThread, WaitForSingleObject, GetExitCodeThread, Sleep, SetLastError, SetFileAttributesW, GetDiskFreeSpaceExW, lstrcatW, ExitProcess, CompareFileTime, GetStartupInfoA
USER32.dll	CharUpperW, EndDialog, DestroyWindow, KillTimer, ReleaseDC, DispatchMessageW, GetMessageW, SetTimer, CreateWindowExW, ScreenToClient, GetWindowRect, wsprintfW, GetParent, GetSystemMenu, EnableMenuItem, EnableWindow, MessageBeep, LoadIconW, LoadImageW, wvsprintfW, IsWindow, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, SetFocus, SetWindowLongW, GetSystemMetrics, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, wsprintfA, SetWindowTextW, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, CopyImage, SendMessageW, GetWindowDC
GDI32.dll	GetCurrentObject, StretchBlt, SetStretchBltMode, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetObjectW, GetDeviceCaps, DeleteObject, CreateFontIndirectW, DeleteDC
SHELL32.dll	SHGetFileInfoW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, SHGetSpecialFolderPathW, ShellExecuteW
ole32.dll	CoInitialize, CreateStreamOnHGlobal, CoCreateInstance
OLEAUT32.dll	VariantClear, OleLoadPicture, SysAllocString
MSVCRT.dll	__set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, memset, _wcsnicmp, strncmp, malloc, memmove, _wtol, memcpy, free, memcmp, _purecall, ??2@YAPAXI@Z, ??3@YAXPAX@Z, _except_handler3, _controlfp

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States
Chinese	China

Target ID:	0
Start time:	14:56:58
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\zPJUOck9wt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zPJUOck9wt.exe"
Imagebase:	0x400000
File size:	21'615'909 bytes
MD5 hash:	1BF851229CDC8A1B97523ED4FA48B977
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	14:57:02
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\Update.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	14:57:02
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	14:57:02
Start date:	28/12/2024
Path:	C:\Users\Public\Bilite\Axialis\Update.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Bilite\Axialis\Update.exe
Imagebase:	0x850000
File size:	395'368 bytes
MD5 hash:	FB325C945A08D06FE91681179BDCCC66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true