Summary

9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b

File 9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b

Summary
Download Resubmit sample

Size 1.1MB
Type PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 9fab10c7583e122a81afbae813f145b8
SHA1 24cefa43fc3da3911c1962ee1df4d5f649449e62
SHA256 9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b
SHA512
a1cdffd7dcd9d8828c30c4bd7205330f0b6ffeb2488a84bd8a3c51272b7f2fe8717962b28ee990ce835b5029c17431e85f2b1d69cd6ca52ef35053a5da5a2e54
CRC32 D5BD7434
ssdeep None
Yara
  • keylogger - Run a keylogger
  • win_mutex - Create or check mutex
  • win_files_operation - Affect private profile

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

7184610

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Nov. 16, 2025, 3:35 p.m. Nov. 16, 2025, 3:41 p.m. 387 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-11-08 12:44:22,030 [analyzer] DEBUG: Starting analyzer from: C:\tmpwwr_kc
2025-11-08 12:44:22,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\tAzoYYyesIFEadySie
2025-11-08 12:44:22,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\EBRDsPnphGqwKBuEAKFyZkeBIt
2025-11-08 12:44:22,312 [analyzer] DEBUG: Started auxiliary module Curtain
2025-11-08 12:44:22,312 [analyzer] DEBUG: Started auxiliary module DbgView
2025-11-08 12:44:22,842 [analyzer] DEBUG: Started auxiliary module Disguise
2025-11-08 12:44:23,108 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-11-08 12:44:23,108 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-11-08 12:44:23,108 [analyzer] DEBUG: Started auxiliary module Human
2025-11-08 12:44:23,108 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-11-08 12:44:23,108 [analyzer] DEBUG: Started auxiliary module Reboot
2025-11-08 12:44:23,187 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-11-08 12:44:23,187 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-11-08 12:44:23,187 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-11-08 12:44:23,187 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-11-08 12:44:23,358 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe' with arguments '' and pid 2664
2025-11-08 12:44:23,592 [analyzer] DEBUG: Loaded monitor into process with pid 2664
2025-11-08 12:44:23,921 [analyzer] INFO: Added new file to list with pid 2664 and path C:\Users\Administrator\AppData\Local\Temp\9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
2025-11-08 12:44:25,217 [analyzer] INFO: Injected into process with pid 2796 and name ''
2025-11-08 12:44:25,358 [analyzer] INFO: Process with pid 2664 has terminated
2025-11-08 12:44:25,390 [analyzer] DEBUG: Loaded monitor into process with pid 2796
2025-11-08 12:44:31,062 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\14232B434CF29D4C4FB335A86D7FFFE3
2025-11-08 12:44:31,078 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14232B434CF29D4C4FB335A86D7FFFE3
2025-11-08 12:44:31,092 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\Local\Temp\Cab703D.tmp
2025-11-08 12:44:31,125 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\Local\Temp\Tar703E.tmp
2025-11-08 12:44:31,296 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-11-08 12:44:31,312 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-11-08 12:44:31,328 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\Local\Temp\Cab712A.tmp
2025-11-08 12:44:31,342 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\Local\Temp\Tar712B.tmp
2025-11-08 12:44:31,530 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-11-08 12:44:31,546 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-11-08 12:44:31,608 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
2025-11-08 12:44:31,625 [analyzer] INFO: Added new file to list with pid 2796 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
2025-11-08 12:44:52,358 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-11-08 12:44:52,765 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-11-08 12:44:52,765 [lib.api.process] INFO: Successfully terminated process with pid 2796.
2025-11-08 12:44:52,828 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-11-16 15:35:08,901 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:09,922 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:10,948 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:11,974 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:13,002 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:14,030 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:15,059 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:16,089 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:17,125 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:18,161 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:19,336 [cuckoo.core.scheduler] DEBUG: Task #7095204: no machine available yet
2025-11-16 15:35:20,358 [cuckoo.core.scheduler] INFO: Task #7095204: acquired machine win7x645 (label=win7x645)
2025-11-16 15:35:20,358 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.205 for task #7095204
2025-11-16 15:35:20,693 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1000553 (interface=vboxnet0, host=192.168.168.205)
2025-11-16 15:35:25,037 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x645
2025-11-16 15:35:26,165 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x645 to vmcloak
2025-11-16 15:38:24,049 [cuckoo.core.guest] INFO: Starting analysis #7095204 on guest (id=win7x645, ip=192.168.168.205)
2025-11-16 15:38:25,058 [cuckoo.core.guest] DEBUG: win7x645: not ready yet
2025-11-16 15:38:30,259 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x645, ip=192.168.168.205)
2025-11-16 15:38:30,374 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x645, ip=192.168.168.205, monitor=latest, size=6660546)
2025-11-16 15:38:32,234 [cuckoo.core.resultserver] DEBUG: Task #7095204: live log analysis.log initialized.
2025-11-16 15:38:33,180 [cuckoo.core.resultserver] DEBUG: Task #7095204 is sending a BSON stream
2025-11-16 15:38:33,767 [cuckoo.core.resultserver] DEBUG: Task #7095204 is sending a BSON stream
2025-11-16 15:38:34,427 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'shots/0001.jpg'
2025-11-16 15:38:34,448 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 117609
2025-11-16 15:38:35,456 [cuckoo.core.resultserver] DEBUG: Task #7095204 is sending a BSON stream
2025-11-16 15:38:35,547 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/9af0a7078db15962_old_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe'
2025-11-16 15:38:35,558 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 1114113
2025-11-16 15:38:41,285 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/d12dd18018f984aa_Cab703D.tmp'
2025-11-16 15:38:41,287 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 58383
2025-11-16 15:38:41,293 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/78eeb661b72a34ca_Tar703E.tmp'
2025-11-16 15:38:41,296 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 146584
2025-11-16 15:38:41,507 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/33ba8221ff3f5211_Cab712A.tmp'
2025-11-16 15:38:41,514 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 73211
2025-11-16 15:38:41,517 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/4018ab25d7d15f77_Tar712B.tmp'
2025-11-16 15:38:41,526 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 189652
2025-11-16 15:38:42,777 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'shots/0002.jpg'
2025-11-16 15:38:42,801 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 118606
2025-11-16 15:38:46,734 [cuckoo.core.guest] DEBUG: win7x645: analysis #7095204 still processing
2025-11-16 15:38:47,003 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'shots/0003.jpg'
2025-11-16 15:38:47,018 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 118754
2025-11-16 15:38:48,180 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'shots/0004.jpg'
2025-11-16 15:38:48,342 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 120278
2025-11-16 15:38:59,591 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'shots/0005.jpg'
2025-11-16 15:38:59,605 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 122932
2025-11-16 15:39:01,868 [cuckoo.core.guest] DEBUG: win7x645: analysis #7095204 still processing
2025-11-16 15:39:02,653 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'curtain/1762602292.52.curtain.log'
2025-11-16 15:39:02,661 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 36
2025-11-16 15:39:02,868 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'sysmon/1762602292.73.sysmon.xml'
2025-11-16 15:39:02,902 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 1990900
2025-11-16 15:39:02,910 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/e7f5d049e9b28121_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-11-16 15:39:02,913 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 174
2025-11-16 15:39:02,928 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe'
2025-11-16 15:39:02,936 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 1114113
2025-11-16 15:39:02,942 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/6fb1b8e593cb0388_b46811c17859ffb409cf0e904a4aa8f8'
2025-11-16 15:39:02,944 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 530
2025-11-16 15:39:02,945 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/ebd41040e4bb3ec7_14232b434cf29d4c4fb335a86d7fffe3'
2025-11-16 15:39:02,947 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 889
2025-11-16 15:39:02,948 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/fce0a2a8dde837c4_94308059b57b3142e455b38a6eb92015'
2025-11-16 15:39:02,975 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 344
2025-11-16 15:39:02,979 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/0f71708dbfee304a_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-11-16 15:39:02,981 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 1739
2025-11-16 15:39:02,982 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/af1ef4136bafc1af_14232b434cf29d4c4fb335a86d7fffe3'
2025-11-16 15:39:02,984 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 170
2025-11-16 15:39:02,985 [cuckoo.core.resultserver] DEBUG: Task #7095204: File upload for 'files/892f726ffd0db22e_b46811c17859ffb409cf0e904a4aa8f8'
2025-11-16 15:39:02,987 [cuckoo.core.resultserver] DEBUG: Task #7095204 uploaded file length: 170
2025-11-16 15:39:02,988 [cuckoo.core.resultserver] DEBUG: Task #7095204 had connection reset for <Context for LOG>
2025-11-16 15:39:04,882 [cuckoo.core.guest] INFO: win7x645: analysis completed successfully
2025-11-16 15:39:04,890 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-11-16 15:39:04,917 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-11-16 15:39:06,004 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x645 to path /srv/cuckoo/cwd/storage/analyses/7095204/memory.dmp
2025-11-16 15:39:06,005 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x645
2025-11-16 15:41:34,196 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.205 for task #7095204
2025-11-16 15:41:36,512 [cuckoo.core.scheduler] DEBUG: Released database task #7095204
2025-11-16 15:41:36,535 [cuckoo.core.scheduler] INFO: Task #7095204: analysis procedure completed

Signatures

Yara rules detected for file (3 events)
description Run a keylogger rule keylogger
description Create or check mutex rule win_mutex
description Affect private profile rule win_files_operation
Allocates read-write-execute memory (usually to unpack itself) (20 events)
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 1130496
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 667648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 184320
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 282624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00430000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00475000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00479000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 667648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0dcb0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 274432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00413000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00415000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00418000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)
section .l1
section CPADinfo
One or more processes crashed (19 events)
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 89062384
registers.edi: 3090896
registers.eax: 17
registers.ebp: 89062428
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 109181936
registers.edi: 3090896
registers.eax: 17
registers.ebp: 109181980
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 125959152
registers.edi: 3090896
registers.eax: 17
registers.ebp: 125959196
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 142736368
registers.edi: 3090896
registers.eax: 17
registers.ebp: 142736412
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 159513584
registers.edi: 3090896
registers.eax: 17
registers.ebp: 159513628
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 176290800
registers.edi: 3090896
registers.eax: 17
registers.ebp: 176290844
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 193068016
registers.edi: 3090896
registers.eax: 17
registers.ebp: 193068060
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 210303984
registers.edi: 3090896
registers.eax: 17
registers.ebp: 210304028
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 228719600
registers.edi: 3090896
registers.eax: 17
registers.ebp: 228719644
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 246414320
registers.edi: 3090896
registers.eax: 17
registers.ebp: 246414364
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x7784e57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x77838046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x7702185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x7610d57a
I_CryptNetGetConnectivity+0x6df I_CryptNetSetUrlCachePreFetchInfo-0x1947 cryptnet+0x738a @ 0x7403738a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x760f33aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x77819f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x77819f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 246414928
registers.edi: 3090896
registers.eax: 17
registers.ebp: 246414972
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 266402800
registers.edi: 3090896
registers.eax: 17
registers.ebp: 266402844
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x7784e57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x77838046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x7702185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x7610d57a
I_CryptNetGetConnectivity+0x6df I_CryptNetSetUrlCachePreFetchInfo-0x1947 cryptnet+0x738a @ 0x7403738a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x760f33aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x77819f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x77819f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 266403408
registers.edi: 3090896
registers.eax: 17
registers.ebp: 266403452
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 266402800
registers.edi: 3090896
registers.eax: 17
registers.ebp: 266402844
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x7784e57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x77838046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x7702185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x7610d57a
I_CryptNetGetConnectivity+0x6df I_CryptNetSetUrlCachePreFetchInfo-0x1947 cryptnet+0x738a @ 0x7403738a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x760f33aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x77819f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x77819f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 266403408
registers.edi: 3090896
registers.eax: 17
registers.ebp: 266403452
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 266402800
registers.edi: 3090896
registers.eax: 17
registers.ebp: 266402844
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x77840546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x77819ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x77819ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 283180016
registers.edi: 3090896
registers.eax: 17
registers.ebp: 283180060
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x7784e57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x77838046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x7702185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x7610d57a
I_CryptNetGetConnectivity+0x6df I_CryptNetSetUrlCachePreFetchInfo-0x1947 cryptnet+0x738a @ 0x7403738a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x760f33aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x77819f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x77819f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 283180624
registers.edi: 3090896
registers.eax: 17
registers.ebp: 283180668
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

 stacktrace: 
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x7784e57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x77838046
BaseThreadInitThunk+0x19 VerifyConsoleIoHandle-0xac kernel32+0x133b1 @ 0x760f33b1
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x77819f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x77819f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x778403ce
registers.esp: 109182640
registers.edi: 3090896
registers.eax: 17
registers.ebp: 109182684
registers.edx: 2005803136
registers.ebx: 3091776
registers.esi: 4956160
registers.ecx: 17
1 0 0
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem (1 event)
file C:\Users\Administrator\AppData\Local\Temp\9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
Drops a binary and executes it (1 event)
file C:\Users\Administrator\AppData\Local\Temp\9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
Drops an executable to the user AppData folder (2 events)
file C:\Users\Administrator\AppData\Local\Temp\old_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
file C:\Users\Administrator\AppData\Local\Temp\9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 events)
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000000bc
process_name: mobsync.exe
process_identifier: 2184
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: taskhost.exe
process_identifier: 720
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: SearchProtocolHost.exe
process_identifier: 2320
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: conhost.exe
process_identifier: 2488
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: 9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
process_identifier: 2796
1 1 0
Moves the original executable to a new location (1 event)
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: C:\Users\Administrator\AppData\Local\Temp\old_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
flags: 2
oldfilepath_r: C:\Users\Administrator\AppData\Local\Temp\9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
newfilepath: C:\Users\Administrator\AppData\Local\Temp\old_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
oldfilepath: C:\Users\Administrator\AppData\Local\Temp\9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
1 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 event)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 46
family: 0
1 0 0
The binary likely contains encrypted or compressed data indicative of a packer (3 events)
section {u'size_of_data': u'0x00014600', u'virtual_address': u'0x00001000', u'entropy': 7.10229008376572, u'name': u'.rsrc', u'virtual_size': u'0x00014440'} entropy 7.10229008377 description A section with a high entropy has been found
section {u'size_of_data': u'0x0009e400', u'virtual_address': u'0x00018000', u'entropy': 7.948344199125771, u'name': u'.rdata', u'virtual_size': u'0x0009e304'} entropy 7.94834419913 description A section with a high entropy has been found
entropy 0.681124880839 description Overall entropy of this PE file is high
Attempts to create or modify system certificates (1 event)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (10 events)
Time & API Arguments Status Return Repeated

RegSetValueExW

 key_handle: 0x000002b4
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x000002b4
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: Ø×7‘ÆPÜ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x000002b4
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x000002b4
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
value: Network
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName
1 0 0

RegSetValueExW

 key_handle: 0x00000568
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x00000568
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: Ø×7‘ÆPÜ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x00000568
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x00000568
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x00000568
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: Ø×7‘ÆPÜ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x00000568
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Gen:Variant.Lazy.365273 (Engine A), Win32.Trojan.PSE.707O5V (Engine B)
Avast Core Security (Linux) Win32:Evo-gen [Trj]
C4S ClamAV (Linux) Win.Packed.Razy-9836307-0
Trellix (Linux) Trojan-FVOQ
WithSecure (Linux) Trojan.TR/Dropper.Gen
eScan Antivirus (Linux) Gen:Variant.Lazy.365273(DB)
ESET Security (Windows) a variant of Win32/Kryptik.GIRH trojan
Sophos Anti-Virus (Linux) Troj/Agent-BFEY
DrWeb Antivirus (Linux) Trojan.Packed2.49423
ClamAV (Linux) Win.Packed.Razy-9836307-0
Bitdefender Antivirus (Linux) Gen:Variant.Lazy.365273
Kaspersky Standard (Windows) HEUR:Trojan.Win32.Generic
Emsisoft Commandline Scanner (Windows) Gen:Variant.Lazy.365273 (B)
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)
Bkav W32.AIDetectMalware
tehtris Generic.Malware
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.tc
ALYac Gen:Variant.Lazy.365273
Cylance Unsafe
VIPRE Gen:Variant.Lazy.365273
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
BitDefender Gen:Variant.Lazy.365273
K7GW Trojan ( 005a45ef1 )
K7AntiVirus Trojan ( 005a45ef1 )
Arcabit Trojan.Lazy.D592D9
VirIT Trojan.Win32.Copak.A
Symantec Trojan.Glupteba!g2
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.GIRH
APEX Malicious
Avast Win32:Evo-gen [Trj]
ClamAV Win.Packed.Razy-9836307-0
Kaspersky HEUR:Trojan.Win32.Generic
NANO-Antivirus Trojan.Win32.Selfmod.kipfti
MicroWorld-eScan Gen:Variant.Lazy.365273
Rising Trojan.Kryptik!1.B34D (CLASSIC)
Emsisoft Gen:Variant.Lazy.365273 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.Packed2.49423
Zillya Trojan.Kryptik.Win32.4070204
McAfeeD Real Protect-LS!9FAB10C7583E
Trapmine malicious.moderate.ml.score
CTX exe.unknown.lazy
Sophos Troj/Agent-BFEY
SentinelOne Static AI - Malicious PE
Google Detected
Avira TR/Dropper.Gen
Antiy-AVL Trojan/Win32.Kryptik.gify
Kingsoft malware.kb.a.993
Gridinsoft Trojan.Heur!.03216521
Xcitium TrojWare.Win32.Kryptik.TLS@812zm8
Microsoft Trojan:Win32/Glupteba.MT!MTB
ZoneAlarm Troj/Agent-BFEY
GData Win32.Trojan.PSE.15NLAT
Varist W32/Trojan.ULNO-1867
AhnLab-V3 Packed/Win.FJB.R626586
Acronis suspicious
VBA32 Trojan.Copak
TACHYON Trojan/W32.Selfmod
DeepInstinct MALICIOUS
Malwarebytes Generic.Malware.Gen.DDS
Ikarus Trojan.Win32.Glupteba
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.