Cuckoo Sandbox

Name	3843ac7d01269083_ywqoigbytq.exe Download Submit file
Filepath	C:\Temp\ywqoigbytq.exe
Size	361.0KB
Processes	2208 (axsqkicausnkfdxv.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d68a55fc2c275e6e439a6d670a560845`
SHA1	`e372bc364cc7de5c23b1a1c66ad3b4536e598225`
SHA256	`3843ac7d012690832b4deea56810a19b4c9ce4ecc600687037802e44d7cebdd1`
CRC32	`D57CFE26`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Name	44d358613af207e2_i_ywqoigbytq.exe Download Submit file
Filepath	C:\Temp\i_ywqoigbytq.exe
Size	361.0KB
Processes	2208 (axsqkicausnkfdxv.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`61db0f8b44c70f9e6357e7a7a296a933`
SHA1	`15a665f2eba8aa65b3945f4f808ed42b8a4c1996`
SHA256	`44d358613af207e2292a25c130da56c2122c1116493bafbdb67bb645db7ace77`
CRC32	`C754A200`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Dropped Files