Cuckoo Sandbox

File 1cda3401c20b0c4b35efb2dc7f30d3787e31e378cc5de8d732ee556b0a585275

Summary
Download Resubmit sample Download yara

Size	2.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7cda6f75a79debbacb219be080fef938`
SHA1	`f474215578cd3b4032cd6f7eb1f47394acce11dd`
SHA256	`1cda3401c20b0c4b35efb2dc7f30d3787e31e378cc5de8d732ee556b0a585275`
SHA512	`d613b8413cf65b1c26ffa4c028ff9efefb0a19c3e885fa636775dbc1d55947ab1724f6f190f35b055fbc37ae0b9a5c7c0dcdfca757d7a7f175a3fa57cd6a3ca5`
CRC32	`09B7D024`
ssdeep	`None`
Yara	anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process network_http - Communications over HTTP escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger win_registry - Affect system registries win_token - Affect system token win_files_operation - Affect private profile

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

6650082

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	June 30, 2025, 5:51 p.m.	June 30, 2025, 5:53 p.m.	109 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-06-23 02:41:37,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpriinqn
2025-06-23 02:41:37,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\ZNsydmZYIZXvZLrXxxJiCYWvMczxD
2025-06-23 02:41:37,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\YuZydcVSwutBdJXpEorOLnOw
2025-06-23 02:41:37,265 [analyzer] DEBUG: Started auxiliary module Curtain
2025-06-23 02:41:37,265 [analyzer] DEBUG: Started auxiliary module DbgView
2025-06-23 02:41:37,655 [analyzer] DEBUG: Started auxiliary module Disguise
2025-06-23 02:41:37,842 [analyzer] DEBUG: Loaded monitor into process with pid 512
2025-06-23 02:41:37,842 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-06-23 02:41:37,842 [analyzer] DEBUG: Started auxiliary module Human
2025-06-23 02:41:37,842 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-06-23 02:41:37,842 [analyzer] DEBUG: Started auxiliary module Reboot
2025-06-23 02:41:37,937 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-06-23 02:41:37,937 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-06-23 02:41:37,937 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-06-23 02:41:37,937 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-06-23 02:41:38,140 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\1cda3401c20b0c4b35efb2dc7f30d3787e31e378cc5de8d732ee556b0a585275.exe' with arguments '' and pid 1368
2025-06-23 02:41:38,405 [analyzer] DEBUG: Loaded monitor into process with pid 1368
2025-06-23 02:41:39,015 [analyzer] INFO: Added new file to list with pid 1368 and path C:\Users\Administrator\8663598701\path.ini
2025-06-23 02:41:39,125 [analyzer] INFO: Added new file to list with pid 1368 and path C:\Users\Administrator\AppData\Local\Temp\fmstuek.exe
2025-06-23 02:41:39,592 [analyzer] INFO: Injected into process with pid 2648 and name u'fmstuek.exe'
2025-06-23 02:41:39,687 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2648.
2025-06-23 02:41:39,875 [analyzer] DEBUG: Loaded monitor into process with pid 2648
2025-06-23 02:41:40,140 [analyzer] INFO: Process with pid 1368 has terminated
2025-06-23 02:41:40,233 [analyzer] INFO: Added pid 2648 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\fmstuek.exe'
2025-06-23 02:41:40,405 [analyzer] INFO: Added new file to list with pid 2648 and path C:\Users\Administrator\AppData\Local\Temp\gomgrjwazw.exe
2025-06-23 02:41:40,703 [analyzer] INFO: Injected into process with pid 2528 and name u'gomgrjwazw.exe'
2025-06-23 02:41:40,842 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2528.
2025-06-23 02:41:41,015 [analyzer] DEBUG: Loaded monitor into process with pid 2528
2025-06-23 02:41:41,140 [analyzer] INFO: Process with pid 2648 has terminated
2025-06-23 02:41:41,342 [analyzer] INFO: Added pid 2528 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\gomgrjwazw.exe'
2025-06-23 02:41:41,483 [analyzer] INFO: Added new file to list with pid 2528 and path C:\Users\Administrator\AppData\Local\Temp\lwrjfaqsl.exe
2025-06-23 02:41:41,796 [analyzer] INFO: Injected into process with pid 712 and name u'lwrjfaqsl.exe'
2025-06-23 02:41:41,937 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 712.
2025-06-23 02:41:42,125 [analyzer] DEBUG: Loaded monitor into process with pid 712
2025-06-23 02:41:42,140 [analyzer] INFO: Process with pid 2528 has terminated
2025-06-23 02:41:42,546 [analyzer] INFO: Added pid 712 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\lwrjfaqsl.exe'
2025-06-23 02:41:42,608 [analyzer] INFO: Added new file to list with pid 712 and path C:\Users\Administrator\AppData\Local\Temp\bvgkueua.exe
2025-06-23 02:41:42,890 [analyzer] INFO: Injected into process with pid 2564 and name u'bvgkueua.exe'
2025-06-23 02:41:43,046 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2564.
2025-06-23 02:41:43,217 [analyzer] DEBUG: Loaded monitor into process with pid 2564
2025-06-23 02:41:43,640 [analyzer] INFO: Added pid 2564 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\bvgkueua.exe'
2025-06-23 02:41:43,703 [analyzer] INFO: Added new file to list with pid 2564 and path C:\Users\Administrator\AppData\Local\Temp\lwhgoqb.exe
2025-06-23 02:41:43,967 [analyzer] INFO: Injected into process with pid 568 and name u'lwhgoqb.exe'
2025-06-23 02:41:44,140 [analyzer] INFO: Process with pid 712 has terminated
2025-06-23 02:41:44,155 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 568.
2025-06-23 02:41:44,342 [analyzer] DEBUG: Loaded monitor into process with pid 568
2025-06-23 02:41:44,812 [analyzer] INFO: Added pid 568 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\lwhgoqb.exe'
2025-06-23 02:41:44,983 [analyzer] INFO: Added new file to list with pid 568 and path C:\Users\Administrator\AppData\Local\Temp\xyfleaj.exe
2025-06-23 02:41:45,140 [analyzer] INFO: Process with pid 2564 has terminated
2025-06-23 02:41:45,358 [analyzer] INFO: Injected into process with pid 2512 and name u'xyfleaj.exe'
2025-06-23 02:41:45,515 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2512.
2025-06-23 02:41:45,687 [analyzer] DEBUG: Loaded monitor into process with pid 2512
2025-06-23 02:41:46,140 [analyzer] INFO: Process with pid 568 has terminated
2025-06-23 02:41:46,140 [analyzer] INFO: Added new file to list with pid 2512 and path C:\Users\Administrator\AppData\Local\Temp\wwn.exe
2025-06-23 02:41:46,530 [analyzer] INFO: Injected into process with pid 1436 and name u'wwn.exe'
2025-06-23 02:41:46,671 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1436.
2025-06-23 02:41:46,875 [analyzer] DEBUG: Loaded monitor into process with pid 1436
2025-06-23 02:41:47,140 [analyzer] INFO: Process with pid 2512 has terminated
2025-06-23 02:41:47,280 [analyzer] INFO: Added new file to list with pid 1436 and path C:\Users\Administrator\AppData\Local\Temp\qyzfalqgp.exe
2025-06-23 02:41:47,562 [analyzer] INFO: Injected into process with pid 2156 and name u'qyzfalqgp.exe'
2025-06-23 02:41:47,717 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2156.
2025-06-23 02:41:47,921 [analyzer] DEBUG: Loaded monitor into process with pid 2156
2025-06-23 02:41:48,140 [analyzer] INFO: Process with pid 1436 has terminated
2025-06-23 02:41:48,312 [analyzer] INFO: Added new file to list with pid 2156 and path C:\Users\Administrator\AppData\Local\Temp\zibvtumqd.exe
2025-06-23 02:41:48,578 [analyzer] INFO: Injected into process with pid 2356 and name u'zibvtumqd.exe'
2025-06-23 02:41:48,750 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2356.
2025-06-23 02:41:48,937 [analyzer] DEBUG: Loaded monitor into process with pid 2356
2025-06-23 02:41:49,140 [analyzer] INFO: Process with pid 2156 has terminated
2025-06-23 02:41:49,405 [analyzer] INFO: Added new file to list with pid 2356 and path C:\Users\Administrator\AppData\Local\Temp\elnkug.exe
2025-06-23 02:41:49,655 [analyzer] INFO: Injected into process with pid 2292 and name u'elnkug.exe'
2025-06-23 02:41:49,812 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2292.
2025-06-23 02:41:50,015 [analyzer] DEBUG: Loaded monitor into process with pid 2292
2025-06-23 02:41:50,140 [analyzer] INFO: Process with pid 2356 has terminated
2025-06-23 02:41:50,467 [analyzer] INFO: Added pid 2292 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\elnkug.exe'
2025-06-23 02:41:50,546 [analyzer] INFO: Added new file to list with pid 2292 and path C:\Users\Administrator\AppData\Local\Temp\zsf.exe
2025-06-23 02:41:50,858 [analyzer] INFO: Injected into process with pid 2988 and name u'zsf.exe'
2025-06-23 02:41:51,030 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2988.
2025-06-23 02:41:51,140 [analyzer] INFO: Process with pid 2292 has terminated
2025-06-23 02:41:51,217 [analyzer] DEBUG: Loaded monitor into process with pid 2988
2025-06-23 02:41:51,625 [analyzer] INFO: Added new file to list with pid 2988 and path C:\Users\Administrator\AppData\Local\Temp\zafwhg.exe
2025-06-23 02:41:51,983 [analyzer] INFO: Injected into process with pid 2972 and name u'zafwhg.exe'
2025-06-23 02:41:52,155 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2972.
2025-06-23 02:41:52,342 [analyzer] DEBUG: Loaded monitor into process with pid 2972
2025-06-23 02:41:52,717 [analyzer] INFO: Added new file to list with pid 2972 and path C:\Users\Administrator\AppData\Local\Temp\bvldeyx.exe
2025-06-23 02:41:53,078 [analyzer] INFO: Injected into process with pid 2800 and name u'bvldeyx.exe'
2025-06-23 02:41:53,140 [analyzer] INFO: Process with pid 2988 has terminated
2025-06-23 02:41:53,217 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2800.
2025-06-23 02:41:53,421 [analyzer] DEBUG: Loaded monitor into process with pid 2800
2025-06-23 02:41:53,828 [analyzer] INFO: Added pid 2800 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\bvldeyx.exe'
2025-06-23 02:41:53,905 [analyzer] INFO: Added new file to list with pid 2800 and path C:\Users\Administrator\AppData\Local\Temp\rbbykxeqd.exe
2025-06-23 02:41:54,125 [analyzer] INFO: Injected into process with pid 2788 and name u'rbbykxeqd.exe'
2025-06-23 02:41:54,140 [analyzer] INFO: Process with pid 2972 has terminated
2025-06-23 02:41:54,217 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2788.
2025-06-23 02:41:54,375 [analyzer] DEBUG: Loaded monitor into process with pid 2788
2025-06-23 02:41:54,750 [analyzer] INFO: Added new file to list with pid 2788 and path C:\Users\Administrator\AppData\Local\Temp\jekgpjugw.exe
2025-06-23 02:41:55,046 [analyzer] INFO: Injected into process with pid 3032 and name u'jekgpjugw.exe'
2025-06-23 02:41:55,140 [analyzer] INFO: Process with pid 2800 has terminated
2025-06-23 02:41:55,171 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3032.
2025-06-23 02:41:55,390 [analyzer] DEBUG: Loaded monitor into process with pid 3032
2025-06-23 02:41:55,780 [analyzer] INFO: Added pid 3032 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\jekgpjugw.exe'
2025-06-23 02:41:55,858 [analyzer] INFO: Added new file to list with pid 3032 and path C:\Users\Administrator\AppData\Local\Temp\jxm.exe
2025-06-23 02:41:56,140 [analyzer] INFO: Process with pid 2788 has terminated
2025-06-23 02:41:56,140 [analyzer] INFO: Injected into process with pid 2944 and name u'jxm.exe'
2025-06-23 02:41:56,250 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2944.
2025-06-23 02:41:56,421 [analyzer] DEBUG: Loaded monitor into process with pid 2944
2025-06-23 02:41:56,858 [analyzer] INFO: Added pid 2944 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\jxm.exe'
2025-06-23 02:41:56,858 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\jxm.exe
2025-06-23 02:41:56,875 [analyzer] INFO: Added new file to list with pid 2944 and path C:\Users\Administrator\AppData\Local\Temp\xgstme.exe
2025-06-23 02:41:57,140 [analyzer] INFO: Process with pid 3032 has terminated
2025-06-23 02:41:57,140 [analyzer] INFO: Injected into process with pid 1348 and name u'xgstme.exe'
2025-06-23 02:41:57,265 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1348.
2025-06-23 02:41:57,453 [analyzer] DEBUG: Loaded monitor into process with pid 1348
2025-06-23 02:41:57,858 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\jxm.exe
2025-06-23 02:41:57,858 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\ose00000.exe
2025-06-23 02:41:57,875 [analyzer] INFO: Added new file to list with pid 1348 and path C:\Users\Administrator\AppData\Local\Temp\efky.exe
2025-06-23 02:41:58,108 [analyzer] INFO: Injected into process with pid 3160 and name u'efky.exe'
2025-06-23 02:41:58,140 [analyzer] INFO: Process with pid 2944 has terminated
2025-06-23 02:41:58,217 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3160.
2025-06-23 02:41:58,405 [analyzer] DEBUG: Loaded monitor into process with pid 3160
2025-06-23 02:41:58,750 [analyzer] INFO: Added pid 3160 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\efky.exe'
2025-06-23 02:41:58,750 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\efky.exe
2025-06-23 02:41:58,750 [analyzer] INFO: Added new file to list with pid 3160 and path C:\Users\Administrator\AppData\Local\Temp\prysvo.exe
2025-06-23 02:41:58,983 [analyzer] INFO: Injected into process with pid 3264 and name u'prysvo.exe'
2025-06-23 02:41:59,078 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3264.
2025-06-23 02:41:59,140 [analyzer] INFO: Process with pid 1348 has terminated
2025-06-23 02:41:59,265 [analyzer] DEBUG: Loaded monitor into process with pid 3264
2025-06-23 02:41:59,625 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\efky.exe
2025-06-23 02:41:59,640 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\ose00000.exe
2025-06-23 02:41:59,655 [analyzer] INFO: Added new file to list with pid 3264 and path C:\Users\Administrator\AppData\Local\Temp\jqbjowkt.exe
2025-06-23 02:41:59,921 [analyzer] INFO: Injected into process with pid 3376 and name u'jqbjowkt.exe'
2025-06-23 02:42:00,030 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3376.
2025-06-23 02:42:00,140 [analyzer] INFO: Process with pid 3160 has terminated
2025-06-23 02:42:00,217 [analyzer] DEBUG: Loaded monitor into process with pid 3376
2025-06-23 02:42:00,562 [analyzer] INFO: Added pid 3376 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\jqbjowkt.exe'
2025-06-23 02:42:00,562 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\jqbjowkt.exe
2025-06-23 02:42:00,578 [analyzer] INFO: Added new file to list with pid 3376 and path C:\Users\Administrator\AppData\Local\Temp\valxxakp.exe
2025-06-23 02:42:00,858 [analyzer] INFO: Injected into process with pid 3580 and name u'valxxakp.exe'
2025-06-23 02:42:00,953 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3580.
2025-06-23 02:42:01,140 [analyzer] DEBUG: Loaded monitor into process with pid 3580
2025-06-23 02:42:01,140 [analyzer] INFO: Process with pid 3264 has terminated
2025-06-23 02:42:01,515 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\jqbjowkt.exe
2025-06-23 02:42:01,515 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\ose00000.exe
2025-06-23 02:42:01,530 [analyzer] INFO: Added new file to list with pid 3580 and path C:\Users\Administrator\AppData\Local\Temp\kwdy.exe
2025-06-23 02:42:01,828 [analyzer] INFO: Injected into process with pid 3684 and name u'kwdy.exe'
2025-06-23 02:42:01,953 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3684.
2025-06-23 02:42:02,140 [analyzer] DEBUG: Loaded monitor into process with pid 3684
2025-06-23 02:42:02,140 [analyzer] INFO: Process with pid 3376 has terminated
2025-06-23 02:42:02,500 [analyzer] INFO: Added pid 3684 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\kwdy.exe'
2025-06-23 02:42:02,500 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\kwdy.exe
2025-06-23 02:42:02,515 [analyzer] INFO: Added new file to list with pid 3684 and path C:\Users\Administrator\AppData\Local\Temp\qmkmymfrvt.exe
2025-06-23 02:42:02,765 [analyzer] INFO: Injected into process with pid 3796 and name u'qmkmymfrvt.exe'
2025-06-23 02:42:02,875 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3796.
2025-06-23 02:42:03,046 [analyzer] DEBUG: Loaded monitor into process with pid 3796
2025-06-23 02:42:03,140 [analyzer] INFO: Process with pid 3580 has terminated
2025-06-23 02:42:03,390 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\kwdy.exe
2025-06-23 02:42:03,405 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\ose00000.exe
2025-06-23 02:42:03,421 [analyzer] INFO: Added new file to list with pid 3796 and path C:\Users\Administrator\AppData\Local\Temp\uychba.exe
2025-06-23 02:42:03,687 [analyzer] INFO: Injected into process with pid 3900 and name u'uychba.exe'
2025-06-23 02:42:03,780 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3900.
2025-06-23 02:42:03,967 [analyzer] DEBUG: Loaded monitor into process with pid 3900
2025-06-23 02:42:04,140 [analyzer] INFO: Process with pid 3684 has terminated
2025-06-23 02:42:04,342 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\ose00000.exe
2025-06-23 02:42:04,358 [analyzer] INFO: Added new file to list with pid 3900 and path C:\Users\Administrator\AppData\Local\Temp\wulskpvhsv.exe
2025-06-23 02:42:04,608 [analyzer] INFO: Injected into process with pid 4004 and name u'wulskpvhsv.exe'
2025-06-23 02:42:04,717 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 4004.
2025-06-23 02:42:04,890 [analyzer] DEBUG: Loaded monitor into process with pid 4004
2025-06-23 02:42:05,140 [analyzer] INFO: Process with pid 3796 has terminated
2025-06-23 02:42:05,280 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\ose00000.exe
2025-06-23 02:42:05,296 [analyzer] INFO: Added new file to list with pid 4004 and path C:\Users\Administrator\AppData\Local\Temp\zqiigredl.exe
2025-06-23 02:42:05,578 [analyzer] INFO: Injected into process with pid 3088 and name u'zqiigredl.exe'
2025-06-23 02:42:05,671 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3088.
2025-06-23 02:42:05,858 [analyzer] DEBUG: Loaded monitor into process with pid 3088
2025-06-23 02:42:06,140 [analyzer] INFO: Process with pid 3900 has terminated
2025-06-23 02:42:06,233 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\ose00000.exe
2025-06-23 02:42:06,250 [analyzer] INFO: Added new file to list with pid 3088 and path C:\Users\Administrator\AppData\Local\Temp\fqzso.exe
2025-06-23 02:42:06,483 [analyzer] INFO: Injected into process with pid 3228 and name u'fqzso.exe'
2025-06-23 02:42:06,592 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 3228.
2025-06-23 02:42:06,765 [analyzer] DEBUG: Loaded monitor into process with pid 3228
2025-06-23 02:42:07,092 [analyzer] INFO: Added pid 3228 for u'C:\\Users\\Administrator\\AppData\\Local\\Temp\\fqzso.exe'
2025-06-23 02:42:07,092 [analyzer] WARNING: Too many files: C:\Users\Administrator\AppData\Local\Temp\fqzso.exe
2025-06-23 02:42:07,108 [analyzer] INFO: Added new file to list with pid 3228 and path C:\Users\Administrator\AppData\Local\Temp\uqphruvdhb.exe
2025-06-23 02:42:07,140 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-06-23 02:42:07,296 [analyzer] INFO: Injected into process with pid 3412 and name u'uqphruvdhb.exe'
2025-06-23 02:42:07,342 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-06-23 02:42:07,342 [lib.api.process] INFO: Successfully terminated process with pid 3228.
2025-06-23 02:42:07,342 [lib.api.process] INFO: Successfully terminated process with pid 3412.
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\zibvtumqd.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\valxxakp.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\8663598701\path.ini
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\prysvo.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\wwn.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\zsf.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\uqphruvdhb.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\qmkmymfrvt.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\xyfleaj.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\xgstme.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\zqiigredl.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\wulskpvhsv.exe
2025-06-23 02:42:07,342 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\zafwhg.exe
2025-06-23 02:42:07,358 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\rbbykxeqd.exe
2025-06-23 02:42:07,358 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\uychba.exe
2025-06-23 02:42:07,358 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\temp\qyzfalqgp.exe
2025-06-23 02:42:07,358 [analyzer] INFO: Analysis completed.
2025-06-23 02:42:07,375 [analyzer] ERROR: Pipe command handler exception occurred (command DUMPMEM args '3412').
Traceback (most recent call last):
  File "C:/tmpriinqn/analyzer.py", line 412, in dispatch
    response = fn(arguments)
  File "C:/tmpriinqn/analyzer.py", line 354, in _handle_dumpmem
    dump_memory(int(data))
  File "C:\tmpriinqn\lib\common\decide.py", line 11, in dump_memory
    Process(pid=pid).dump_memory()
  File "C:\tmpriinqn\lib\api\process.py", line 563, in dump_memory
    32 if self.is32bit(pid=self.pid) else 64, self.pid)
  File "C:\tmpriinqn\lib\api\process.py", line 274, in is32bit
    raise CuckooError("Error returned by is32bit: %s" % e.output)
CuckooError: Error returned by is32bit: [-] Error getting access to process: 87!

Cuckoo Log

2025-06-30 17:51:22,529 [cuckoo.core.scheduler] INFO: Task #6620431: acquired machine win7x6426 (label=win7x6426)
2025-06-30 17:51:22,530 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.226 for task #6620431
2025-06-30 17:51:22,818 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3227322 (interface=vboxnet0, host=192.168.168.226)
2025-06-30 17:51:24,426 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6426
2025-06-30 17:51:24,894 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6426 to vmcloak
2025-06-30 17:52:06,181 [cuckoo.core.guest] INFO: Starting analysis #6620431 on guest (id=win7x6426, ip=192.168.168.226)
2025-06-30 17:52:07,187 [cuckoo.core.guest] DEBUG: win7x6426: not ready yet
2025-06-30 17:52:12,230 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6426, ip=192.168.168.226)
2025-06-30 17:52:12,308 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6426, ip=192.168.168.226, monitor=latest, size=6660546)
2025-06-30 17:52:13,729 [cuckoo.core.resultserver] DEBUG: Task #6620431: live log analysis.log initialized.
2025-06-30 17:52:14,516 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:15,078 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:15,684 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/1cda3401c20b0c4b_1cda3401c20b0c4b35efb2dc7f30d3787e31e378cc5de8d732ee556b0a585275.exe'
2025-06-30 17:52:15,740 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856135
2025-06-30 17:52:15,858 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'shots/0001.jpg'
2025-06-30 17:52:15,889 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 133573
2025-06-30 17:52:16,532 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:16,997 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/85509e05e6ee4186_fmstuek.exe'
2025-06-30 17:52:17,173 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856152
2025-06-30 17:52:17,673 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:18,159 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/5d22a94625714077_gomgrjwazw.exe'
2025-06-30 17:52:18,197 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856242
2025-06-30 17:52:18,782 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:19,315 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/c6d048ec30946927_lwrjfaqsl.exe'
2025-06-30 17:52:19,340 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856332
2025-06-30 17:52:19,875 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:20,401 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/c3d265bd92975371_bvgkueua.exe'
2025-06-30 17:52:20,428 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856417
2025-06-30 17:52:21,003 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:21,671 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/8ffbcd93adc3c355_lwhgoqb.exe'
2025-06-30 17:52:21,697 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856431
2025-06-30 17:52:22,344 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:22,862 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/52ad72c05facc1e0_ose00000.exe'
2025-06-30 17:52:22,867 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 174440
2025-06-30 17:52:23,531 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:24,578 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:25,600 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:26,673 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:27,238 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/118fb5ac776edfc6_elnkug.exe'
2025-06-30 17:52:27,262 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856675
2025-06-30 17:52:27,875 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:28,282 [cuckoo.core.guest] DEBUG: win7x6426: analysis #6620431 still processing
2025-06-30 17:52:29,000 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:30,182 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:30,587 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/392180c86269ce48_bvldeyx.exe'
2025-06-30 17:52:30,623 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856809
2025-06-30 17:52:31,032 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:32,133 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:32,549 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'files/25c79cd20122864e_jekgpjugw.exe'
2025-06-30 17:52:32,576 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 2856940
2025-06-30 17:52:33,078 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:34,220 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:35,063 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:35,923 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:36,949 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:37,797 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:38,797 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:39,703 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:40,625 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:41,546 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:42,515 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:43,388 [cuckoo.core.guest] DEBUG: win7x6426: analysis #6620431 still processing
2025-06-30 17:52:43,422 [cuckoo.core.resultserver] DEBUG: Task #6620431 is sending a BSON stream
2025-06-30 17:52:43,965 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'curtain/1750639327.22.curtain.log'
2025-06-30 17:52:43,968 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 36
2025-06-30 17:52:44,080 [cuckoo.core.resultserver] DEBUG: Task #6620431: File upload for 'sysmon/1750639327.34.sysmon.xml'
2025-06-30 17:52:44,261 [cuckoo.core.resultserver] DEBUG: Task #6620431 uploaded file length: 925732
2025-06-30 17:52:44,541 [cuckoo.core.resultserver] DEBUG: Task #6620431 had connection reset for <Context for LOG>
2025-06-30 17:52:46,408 [cuckoo.core.guest] INFO: win7x6426: analysis completed successfully
2025-06-30 17:52:46,431 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-06-30 17:52:46,474 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-06-30 17:52:47,175 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6426 to path /srv/cuckoo/cwd/storage/analyses/6620431/memory.dmp
2025-06-30 17:52:47,175 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6426
2025-06-30 17:53:11,223 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.226 for task #6620431
2025-06-30 17:53:11,816 [cuckoo.core.scheduler] DEBUG: Released database task #6620431
2025-06-30 17:53:11,837 [cuckoo.core.scheduler] INFO: Task #6620431: analysis procedure completed

Signatures

Yara rules detected for file (9 events)

description	Checks if being debugged	rule	anti_dbg
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Communications over HTTP	rule	network_http
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_files_operation

Checks if process is being debugged by a debugger (28 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:41 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:42 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:42 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:42 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:42 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:42 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:42 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:42 a.m.			0	0
IsDebuggerPresent June 23, 2025, 3:42 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.giqtkj

Creates executable files on the filesystem (28 events)

file	C:\Users\Administrator\AppData\Local\Temp\xyfleaj.exe
file	C:\Users\Administrator\AppData\Local\Temp\zsf.exe
file	C:\Users\Administrator\AppData\Local\Temp\zqiigredl.exe
file	C:\Users\Administrator\AppData\Local\Temp\wulskpvhsv.exe
file	C:\Users\Administrator\AppData\Local\Temp\zafwhg.exe
file	C:\Users\Administrator\AppData\Local\Temp\fqzso.exe
file	C:\Users\Administrator\AppData\Local\Temp\rbbykxeqd.exe
file	C:\Users\Administrator\AppData\Local\Temp\uychba.exe
file	C:\Users\Administrator\AppData\Local\Temp\elnkug.exe
file	C:\Users\Administrator\AppData\Local\Temp\jqbjowkt.exe
file	C:\Users\Administrator\AppData\Local\Temp\qyzfalqgp.exe
file	C:\Users\Administrator\AppData\Local\Temp\fmstuek.exe
file	C:\Users\Administrator\AppData\Local\Temp\zibvtumqd.exe
file	C:\Users\Administrator\AppData\Local\Temp\valxxakp.exe
file	C:\Users\Administrator\AppData\Local\Temp\prysvo.exe
file	C:\Users\Administrator\AppData\Local\Temp\wwn.exe
file	C:\Users\Administrator\AppData\Local\Temp\bvgkueua.exe
file	C:\Users\Administrator\AppData\Local\Temp\uqphruvdhb.exe
file	C:\Users\Administrator\AppData\Local\Temp\qmkmymfrvt.exe
file	C:\Users\Administrator\AppData\Local\Temp\jekgpjugw.exe
file	C:\Users\Administrator\AppData\Local\Temp\jxm.exe
file	C:\Users\Administrator\AppData\Local\Temp\bvldeyx.exe
file	C:\Users\Administrator\AppData\Local\Temp\gomgrjwazw.exe
file	C:\Users\Administrator\AppData\Local\Temp\efky.exe
file	C:\Users\Administrator\AppData\Local\Temp\xgstme.exe
file	C:\Users\Administrator\AppData\Local\Temp\kwdy.exe
file	C:\Users\Administrator\AppData\Local\Temp\lwhgoqb.exe
file	C:\Users\Administrator\AppData\Local\Temp\lwrjfaqsl.exe

Drops a binary and executes it (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\fmstuek.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\Administrator\AppData\Local\Temp\1cda3401c20b0c4b35efb2dc7f30d3787e31e378cc5de8d732ee556b0a585275.exe
file	C:\Users\Administrator\AppData\Local\Temp\fmstuek.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x001d4000', u'virtual_address': u'0x000c8000', u'entropy': 7.794775390131092, u'name': u'.rsrc', u'virtual_size': u'0x001d3e1b'}

entropy

7.79477539013

description

A section with a high entropy has been found

entropy

0.69824692279

description

Overall entropy of this PE file is high

Resumed a suspended thread in a remote process potentially indicative of process injection (50 out of 54 events)

Process injection	Process 1368 resumed a thread in remote process 2648
Process injection	Process 2648 resumed a thread in remote process 2528
Process injection	Process 2528 resumed a thread in remote process 712
Process injection	Process 712 resumed a thread in remote process 2564
Process injection	Process 2564 resumed a thread in remote process 568
Process injection	Process 568 resumed a thread in remote process 2512
Process injection	Process 2512 resumed a thread in remote process 1436
Process injection	Process 1436 resumed a thread in remote process 2156
Process injection	Process 2156 resumed a thread in remote process 2356
Process injection	Process 2356 resumed a thread in remote process 2292
Process injection	Process 2292 resumed a thread in remote process 2988
Process injection	Process 2988 resumed a thread in remote process 2972
Process injection	Process 2972 resumed a thread in remote process 2800
Process injection	Process 2800 resumed a thread in remote process 2788
Process injection	Process 2788 resumed a thread in remote process 3032
Process injection	Process 3032 resumed a thread in remote process 2944
Process injection	Process 2944 resumed a thread in remote process 1348
Process injection	Process 1348 resumed a thread in remote process 3160
Process injection	Process 3160 resumed a thread in remote process 3264
Process injection	Process 3264 resumed a thread in remote process 3376
Process injection	Process 3376 resumed a thread in remote process 3580
Process injection	Process 3580 resumed a thread in remote process 3684
Process injection	Process 3684 resumed a thread in remote process 3796
Process injection	Process 3796 resumed a thread in remote process 3900
Process injection	Process 3900 resumed a thread in remote process 4004

Time & API	Arguments	Status
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2648	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2528	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 712	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2564	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 568	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2512	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 1436	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2156	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2356	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2292	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 2988	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2972	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000274 suspend_count: 1 process_identifier: 2800	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2788	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 3032	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2944	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 1348	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 3160	1
NtResumeThread June 23, 2025, 3:41 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 3264	1
NtResumeThread June 23, 2025, 3:42 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 3376	1
NtResumeThread June 23, 2025, 3:42 a.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 3580	1
NtResumeThread June 23, 2025, 3:42 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 3684	1
NtResumeThread June 23, 2025, 3:42 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 3796	1
NtResumeThread June 23, 2025, 3:42 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 3900	1
NtResumeThread June 23, 2025, 3:42 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 4004	1

File has been identified by 12 AntiVirus engine on IRMA as malicious (12 events)

G Data Antivirus (Windows)	Virus: Trojan.GenericKD.76335019 (Engine A)
Avast Core Security (Linux)	Win32:MinerAutoIt-I [Trj]
C4S ClamAV (Linux)	Win.Malware.Autoit-7136020-0
Trellix (Linux)	AUTOIT/Generic.c trojan
WithSecure (Linux)	Heuristic.HEUR/AGEN.1320235
eScan Antivirus (Linux)	Trojan.GenericKD.76335019(DB)
Sophos Anti-Virus (Linux)	Troj/AutoIt-CHN
DrWeb Antivirus (Linux)	Trojan.Inject3.11546
ClamAV (Linux)	Win.Malware.Autoit-7136020-0
Bitdefender Antivirus (Linux)	Trojan.GenericKD.76335019
Kaspersky Standard (Windows)	HackTool.Win32.Gamehack.aiou
Emsisoft Commandline Scanner (Windows)	Trojan.GenericKD.76335019 (B)

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Trojan.GenericKD.76335019
Skyhigh	BehavesLike.Win32.Generic.vc
Cylance	Unsafe
VIPRE	Trojan.GenericKD.76335019
Sangfor	Virus.Win32.Save.a
CrowdStrike	win/grayware_confidence_70% (D)
BitDefender	Trojan.GenericKD.76335019
K7GW	Unwanted-Program ( 0054920e1 )
K7AntiVirus	Unwanted-Program ( 0054920e1 )
Arcabit	Trojan.Generic.D48CC7AB
VirIT	Trojan.Win32.Inject3.RCC
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GameHack.CSL potentially unsafe
APEX	Malicious
Avast	Win32:MinerAutoIt-I [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HackTool.Win32.Gamehack.aiou
Rising	PUF.GameHack!1.B5BD (CLASSIC)
Emsisoft	Trojan.GenericKD.76335019 (B)
F-Secure	Heuristic.HEUR/AGEN.1320235
DrWeb	Trojan.Inject3.11546
TrendMicro	PUA.AutoIt.GAMEHACK.SMP
McAfeeD	ti!1CDA3401C20B
CTX	exe.trojan.generic
Sophos	Troj/AutoIt-CHN
Google	Detected
Avira	HEUR/AGEN.1320235
Antiy-AVL	RiskWare/Win32.Gamehack.csl
Kingsoft	malware.kb.a.983
Gridinsoft	Trojan.Win32.CoinMiner.ka!i
Xcitium	ApplicUnwnt.Win32.HackTool.Gamehack.Y@8nh32t
Microsoft	Trojan:AutoIt/GameHack!pz
ZoneAlarm	Troj/AutoIt-CHN
GData	Trojan.GenericKD.76335019
Varist	W32/Autoit.DKWT-5471
AhnLab-V3	Unwanted/Win32.GameTool.C4201418
TACHYON	Abuse-Worry/W32.OnlineGameHack.Gen
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan-Downloader.Win32.AutoIt
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Trojan.Win32.VSX.PE04C9Z
Tencent	Unk.Win32.Script.404745
TrellixENS	AUTOIT/Generic.c
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	Riskware/GameHack
AVG	Win32:MinerAutoIt-I [Trj]

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File 1cda3401c20b0c4b35efb2dc7f30d3787e31e378cc5de8d732ee556b0a585275

Summary Download Resubmit sample Download yara

Score

Autosubmit

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample Download yara