Windows Analysis Report
S8co1ACRdn.exe

Overview

General Information

Sample name: S8co1ACRdn.exe
renamed because original name is a hash value
Original sample name: 6a605bfcf8816ab1a6e21238fcb55747.exe
Analysis ID: 1464579
MD5: 6a605bfcf8816ab1a6e21238fcb55747
SHA1: 3e3a35e578c8a3faf88abe8fd7791ecc4bca538d
SHA256: 07be352dde09851de71ce7c763537e2b5c567e52fd161304cbaa54895dcd5c8f
Tags: 32exetrojan
Infos:

Detection

CryptOne, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Yara detected Powershell download and execute
Yara detected Vidar stealer
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Sample uses process hollowing technique
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara detected Keylogger Generic

Classification

AV Detection

barindex
Source: https://steamcommunity.com/profiles/76561199707802586 Avira URL Cloud: Label: malware
Source: https://t.me/g067n Avira URL Cloud: Label: malware
Source: 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}
Source: S8co1ACRdn.exe Virustotal: Detection: 35% Perma Link
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.8% probability
Source: S8co1ACRdn.exe Joe Sandbox ML: detected
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetProcAddress
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: LoadLibraryA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: lstrcatA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: OpenEventA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CreateEventA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CloseHandle
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Sleep
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: VirtualFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetSystemInfo
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: VirtualAlloc
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: HeapAlloc
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetComputerNameA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: lstrcpyA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetProcessHeap
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetCurrentProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: lstrlenA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ExitProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetSystemTime
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: advapi32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: gdi32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: user32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: crypt32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ntdll.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetUserNameA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CreateDCA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetDeviceCaps
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ReleaseDC
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sscanf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: NtQueryInformationProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: VMwareVMware
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: HAL9TH
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: JohnDoe
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: DISPLAY
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetFileAttributesA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GlobalLock
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: HeapFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetFileSize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GlobalSize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: IsWow64Process
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Process32Next
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetLocalTime
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: FreeLibrary
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetVolumeInformationA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Process32First
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetLocaleInfoA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetModuleFileNameA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: DeleteFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: FindNextFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: LocalFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: FindClose
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: LocalAlloc
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetFileSizeEx
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ReadFile
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SetFilePointer
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: WriteFile
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CreateFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: FindFirstFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CopyFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: VirtualProtect
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetLastError
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: lstrcpynA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: MultiByteToWideChar
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GlobalFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: WideCharToMultiByte
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GlobalAlloc
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: OpenProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: TerminateProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetCurrentProcessId
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: gdiplus.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ole32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: bcrypt.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: wininet.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: shlwapi.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: shell32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: psapi.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: rstrtmgr.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SelectObject
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: BitBlt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: DeleteObject
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CreateCompatibleDC
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GdiplusStartup
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GdiplusShutdown
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GdipDisposeImage
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GdipFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CoUninitialize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CoInitialize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CoCreateInstance
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: BCryptDecrypt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: BCryptSetProperty
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: BCryptDestroyKey
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetWindowRect
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetDesktopWindow
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetDC
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CloseWindow
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: wsprintfA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CharToOemW
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: wsprintfW
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RegQueryValueExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RegEnumKeyExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RegOpenKeyExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RegCloseKey
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RegEnumValueA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CryptUnprotectData
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SHGetFolderPathA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ShellExecuteExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: InternetOpenUrlA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: InternetConnectA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: InternetCloseHandle
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: InternetOpenA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: HttpSendRequestA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: HttpOpenRequestA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: InternetReadFile
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: InternetCrackUrlA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: StrCmpCA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: StrStrA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: StrCmpCW
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: PathMatchSpecA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RmStartSession
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RmRegisterResources
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RmGetList
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: RmEndSession
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3_open
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3_step
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3_column_text
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3_finalize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3_close
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3_column_blob
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: encrypted_key
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: PATH
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: NSS_Init
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: NSS_Shutdown
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: PK11_FreeSlot
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: PK11_Authenticate
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: C:\ProgramData\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Soft:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: profile:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Host:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Login:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Password:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Opera
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: OperaGX
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Network
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Cookies
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: .txt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: TRUE
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: FALSE
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Autofill
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SELECT name, value FROM autofill
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: History
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Name:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Month:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Year:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Card:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Cookies
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Login Data
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Web Data
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: History
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: logins.json
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: formSubmitURL
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: usernameField
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: encryptedUsername
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: encryptedPassword
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: guid
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: cookies.sqlite
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: formhistory.sqlite
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: places.sqlite
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Plugins
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Local Extension Settings
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Sync Extension Settings
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: IndexedDB
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Opera Stable
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Opera GX Stable
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: CURRENT
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: chrome-extension_
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Local State
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: profiles.ini
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: chrome
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: opera
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: firefox
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Wallets
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ProductName
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ProcessorNameString
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: DisplayName
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: DisplayVersion
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: freebl3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: mozglue.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: msvcp140.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: nss3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: softokn3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: vcruntime140.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \Temp\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: .exe
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: runas
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: open
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: /c start
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %DESKTOP%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %APPDATA%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %USERPROFILE%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %DOCUMENTS%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %PROGRAMFILES%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: %RECENT%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: *.lnk
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Files
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \discord\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \Telegram Desktop\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: key_datas
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: map*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Telegram
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: *.tox
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: *.ini
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Password
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: 00000001
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: 00000002
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: 00000003
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: 00000004
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Pidgin
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \.purple\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: accounts.xml
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: token:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Software\Valve\Steam
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: SteamPath
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \config\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ssfn*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: config.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: DialogConfig.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: libraryfolders.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: loginusers.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \Steam\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: sqlite3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: browsers
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: done
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Soft
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: https
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: POST
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: HTTP/1.1
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: hwid
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: build
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: token
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: file_name
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: file
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: message
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack String decryptor: screenshot.jpg
Source: S8co1ACRdn.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior

Networking

barindex
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor URLs: https://t.me/g067n
Source: global traffic TCP traffic: 192.168.2.5:49706 -> 195.201.251.214:9000
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: t.me
Source: katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windows
Source: katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsC
Source: katAE61.tmp, 00000002.00000003.2085268359.00000000008BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/
Source: katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085268359.00000000008BC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/A
Source: katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085268359.00000000008BC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/E
Source: katAE61.tmp, 00000002.00000002.3275958131.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: katAE61.tmp, 00000002.00000003.2226729619.000000000082D000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.000000000082C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.000000000082C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000082D000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2223471284.000000000082A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab-
Source: S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000000.2026581948.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, katAE61.tmp.0.dr String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: S8co1ACRdn.exe String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/_non
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Types
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/TypesX8
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesm
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-c
Source: katAE61.tmp, 00000002.00000003.2067033169.000000000080F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.cO
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: katAE61.tmp, 00000002.00000003.2355518326.0000000000834000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2223471284.0000000000833000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000834000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214/
Source: katAE61.tmp, 00000002.00000003.2223471284.0000000000833000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214/$)l
Source: katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000
Source: katAE61.tmp, 00000002.00000003.2198311850.000000000088A000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000889000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2199439660.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2199882169.000000000088B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/
Source: katAE61.tmp, 00000002.00000003.2198311850.00000000008C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/$
Source: katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/0
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/40rosoft
Source: katAE61.tmp, 00000002.00000003.2355518326.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/9T
Source: katAE61.tmp, 00000002.00000003.2229881928.00000000008D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/:900014:9000/freebl3.dll
Source: katAE61.tmp, 00000002.00000002.3276644612.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/Mac
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/Microsoft
Source: katAE61.tmp, 00000002.00000003.2198311850.000000000088A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/TT
Source: katAE61.tmp, 00000002.00000003.2230396036.000000000081C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000823000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276231993.0000000000824000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.000000000088A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/X/
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/c
Source: katAE61.tmp, 00000002.00000003.2211467190.000000000088B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/d
Source: katAE61.tmp, 00000002.00000003.2229881928.00000000008CB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/date_1
Source: katAE61.tmp, 00000002.00000003.2230396036.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dlldge
Source: katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dlle
Source: katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dllffsets
Source: katAE61.tmp, 00000002.00000003.2230396036.0000000000842000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dlllt
Source: katAE61.tmp, 00000002.00000003.2355518326.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/l
Source: katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dll.15;
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dlldge
Source: katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dllw
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/msvcp140.dllge
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: katAE61.tmp, 00000002.00000002.3275958131.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/nss3.dll8
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/nss3.dllt
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/q
Source: katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dll7
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dllge
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dllo
Source: katAE61.tmp, 00000002.00000003.2230396036.000000000085F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.000000000085F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.0000000000863000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000862000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2223471284.000000000085C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: katAE61.tmp, 00000002.00000002.3275958131.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276644612.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll_
Source: katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllrv:129.0)
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllser
Source: katAE61.tmp, 00000002.00000002.3274621904.0000000000539000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000040gle
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000ng
Source: katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000ontent-Disposition:
Source: HDGIEB.2.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: HDGIEB.2.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: HDGIEB.2.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HDGIEB.2.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: HDGIEB.2.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HDGIEB.2.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: HDGIEB.2.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/K3b
Source: S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2067033169.0000000000800000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2067033169.000000000080F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.0000000000801000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067n
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067nI
Source: S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: katAE61.tmp, 00000002.00000003.2067033169.000000000080F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.0000000000801000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: HDGIEB.2.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: HDGIEB.2.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: Yara match File source: 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: S8co1ACRdn.exe PID: 5812, type: MEMORYSTR
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Code function: 0_2_02CBB250 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification, 0_2_02CBB250
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Code function: 0_2_02CBBEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess, 0_2_02CBBEF0
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Code function: 0_2_02CBB510 NtProtectVirtualMemory,NtProtectVirtualMemory, 0_2_02CBB510
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Code function: 0_2_02CBC510 0_2_02CBC510
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227B4CF0 2_2_227B4CF0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A209F 2_2_227A209F
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2282A0B0 2_2_2282A0B0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227B66C0 2_2_227B66C0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A47AF 2_2_227A47AF
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2289A590 2_2_2289A590
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227CA560 2_2_227CA560
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227AAA40 2_2_227AAA40
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227AEA80 2_2_227AEA80
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A481D 2_2_227A481D
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228DE800 2_2_228DE800
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A3E3B 2_2_227A3E3B
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228869C0 2_2_228869C0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228BA900 2_2_228BA900
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2289A940 2_2_2289A940
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2297AEBE 2_2_2297AEBE
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22802EE0 2_2_22802EE0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227E6E80 2_2_227E6E80
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A19DD 2_2_227A19DD
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227D3370 2_2_227D3370
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227AF160 2_2_227AF160
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A174E 2_2_227A174E
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227CBAB0 2_2_227CBAB0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227D7810 2_2_227D7810
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A251D 2_2_227A251D
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A290A 2_2_227A290A
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A3AB2 2_2_227A3AB2
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22820090 2_2_22820090
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228C8030 2_2_228C8030
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22828120 2_2_22828120
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227C8680 2_2_227C8680
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227C8763 2_2_227C8763
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22804760 2_2_22804760
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22838760 2_2_22838760
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228E0480 2_2_228E0480
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228A4A60 2_2_228A4A60
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227AC800 2_2_227AC800
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A1EF1 2_2_227A1EF1
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227DCE10 2_2_227DCE10
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227C8D2A 2_2_227C8D2A
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2297D209 2_2_2297D209
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A3580 2_2_227A3580
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228353B0 2_2_228353B0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227B9000 2_2_227B9000
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228C5040 2_2_228C5040
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22849690 2_2_22849690
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2285D6D0 2_2_2285D6D0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22909430 2_2_22909430
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227AD4C0 2_2_227AD4C0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228C9A20 2_2_228C9A20
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A2018 2_2_227A2018
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A1C9E 2_2_227A1C9E
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22855940 2_2_22855940
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A2AA9 2_2_227A2AA9
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A12A8 2_2_227A12A8
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227D1C50 2_2_227D1C50
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22909CC0 2_2_22909CC0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A292D 2_2_227A292D
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\katAE61.tmp 6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: String function: 227A1C2B appears 47 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: String function: 227A415B appears 173 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: String function: 227A1F5A appears 36 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: String function: 227A395E appears 81 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: String function: 227A3AF3 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: String function: 229806B1 appears 36 times
Source: S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameResHack! vs S8co1ACRdn.exe
Source: S8co1ACRdn.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/12@1/2
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\JPD9URQO.htm Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe File created: C:\Users\user\AppData\Local\Temp\katAE61.tmp Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: katAE61.tmp, katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: katAE61.tmp, katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: katAE61.tmp, 00000002.00000003.2223994933.0000000000907000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226457928.0000000000907000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2211467190.0000000000873000.00000004.00000020.00020000.00000000.sdmp, GCBKEC.2.dr, GHCAAA.2.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: katAE61.tmp, katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: S8co1ACRdn.exe Virustotal: Detection: 35%
Source: unknown Process created: C:\Users\user\Desktop\S8co1ACRdn.exe "C:\Users\user\Desktop\S8co1ACRdn.exe"
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Process created: C:\Users\user\AppData\Local\Temp\katAE61.tmp C:\Users\user\AppData\Local\Temp\katAE61.tmp
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Process created: C:\Users\user\AppData\Local\Temp\katAE61.tmp C:\Users\user\AppData\Local\Temp\katAE61.tmp Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: cryptnet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: S8co1ACRdn.exe Static file information: File size 2288128 > 1048576
Source: S8co1ACRdn.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x127800
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr
Source: sqlt[1].dll.2.dr Static PE information: section name: .00cfg
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Code function: 0_2_02CBCA10 push edx; ret 0_2_02CBCC1F
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Code function: 0_2_02CBC310 push edx; ret 0_2_02CBC31B
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A10C8 push ecx; ret 2_2_229A3552
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A1BF9 push ecx; ret 2_2_22944C03
Source: C:\Users\user\Desktop\S8co1ACRdn.exe File created: C:\Users\user\AppData\Local\Temp\katAE61.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: icon.png
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp API coverage: 0.8 %
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: EBFBFB.2.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EBFBFB.2.dr Binary or memory string: discord.comVMware20,11696428655f
Source: EBFBFB.2.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EBFBFB.2.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EBFBFB.2.dr Binary or memory string: global block list test formVMware20,11696428655
Source: EBFBFB.2.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: EBFBFB.2.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EBFBFB.2.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: EBFBFB.2.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EBFBFB.2.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: EBFBFB.2.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: EBFBFB.2.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EBFBFB.2.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EBFBFB.2.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware)
Source: EBFBFB.2.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: EBFBFB.2.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EBFBFB.2.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EBFBFB.2.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EBFBFB.2.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: EBFBFB.2.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: EBFBFB.2.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: EBFBFB.2.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: EBFBFB.2.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWM
Source: EBFBFB.2.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EBFBFB.2.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: EBFBFB.2.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EBFBFB.2.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: EBFBFB.2.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: EBFBFB.2.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: EBFBFB.2.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: EBFBFB.2.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_227A2C8E
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A46A6 GetProcessHeap, 2_2_227A46A6
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A42AF SetUnhandledExceptionFilter, 2_2_227A42AF
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_227A2C8E

HIPS / PFW / Operating System Protection Evasion

barindex
Source: Yara match File source: Process Memory Space: S8co1ACRdn.exe PID: 5812, type: MEMORYSTR
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Memory allocated: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Code function: 0_2_02CBBEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess, 0_2_02CBBEF0
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Section unmapped: C:\Users\user\AppData\Local\Temp\katAE61.tmp base address: 400000 Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 425000 Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 42E000 Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 643000 Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe Process created: C:\Users\user\AppData\Local\Temp\katAE61.tmp C:\Users\user\AppData\Local\Temp\katAE61.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 2_2_227A298C
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: EnumSystemLocalesW, 2_2_2297FF17
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: GetLocaleInfoW, 2_2_227A2112
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: GetLocaleInfoW, 2_2_227A2112
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227A433C GetSystemTimeAsFileTime, 2_2_227A433C
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22984A46 GetTimeZoneInformation, 2_2_22984A46
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: katAE61.tmp, 00000002.00000003.2223471284.0000000000850000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

barindex
Source: Yara match File source: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.4200000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.4200000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.23c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.2c87719.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.23c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: S8co1ACRdn.exe PID: 5812, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: katAE61.tmp PID: 2568, type: MEMORYSTR
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: Yara match File source: Process Memory Space: katAE61.tmp PID: 2568, type: MEMORYSTR

Remote Access Functionality

barindex
Source: Yara match File source: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.4200000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.4200000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.23c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.2c87719.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.S8co1ACRdn.exe.23c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: S8co1ACRdn.exe PID: 5812, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: katAE61.tmp PID: 2568, type: MEMORYSTR
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2280E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset, 2_2_2280E200
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2280E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 2_2_2280E090
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2281E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 2_2_2281E170
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2281A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value, 2_2_2281A6F0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227B66C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 2_2_227B66C0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227FEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code, 2_2_227FEF30
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228837E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 2_2_228837E0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22863770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 2_2_22863770
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227CB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64, 2_2_227CB400
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227D7810 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 2_2_227D7810
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22818200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset, 2_2_22818200
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22884140 sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_initialize,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset, 2_2_22884140
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227F06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset, 2_2_227F06E0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227C8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64, 2_2_227C8680
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227D8430 sqlite3_bind_int64, 2_2_227D8430
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227F8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset, 2_2_227F8550
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227B4820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize, 2_2_227B4820
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227D8970 sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 2_2_227D8970
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227D0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, 2_2_227D0FB0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227D8CB0 sqlite3_bind_zeroblob, 2_2_227D8CB0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22884D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, 2_2_22884D40
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2285D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 2_2_2285D3B0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22839090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf, 2_2_22839090
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228451D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 2_2_228451D0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2287D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 2_2_2287D610
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228C14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, 2_2_228C14D0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228CD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log, 2_2_228CD4F0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228455B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 2_2_228455B0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2281DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, 2_2_2281DB10
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_228CD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, 2_2_228CD9E0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22845910 sqlite3_mprintf,sqlite3_bind_int64, 2_2_22845910
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_2281DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset, 2_2_2281DFC0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_22821FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 2_2_22821FE0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp Code function: 2_2_227B5C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, 2_2_227B5C70
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs