Windows Analysis Report
update_390_391.exe

ID:	1468065
Product:	CloudBasic
Start time:	09:50:44
Start date:	05.07.2024
Sample:	update_390_391.exe
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c2c9b0b8b275defd42be10314f13b480
SHA1:	1a268efea3cc2f56ddb154487e501550f0540696
SHA256:	04ce55570cf7a827499636a577617bcdc80bfb1239f8b71caa7559a90f30b528
Filetype:	Win32 Executable (generic) a (10002005/4) 99.70%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\Desktop\ _avk_0.0.0.txt	ISO-8859 text, with CRLF line terminators	7E13A91153CABFE9DFED5FD0B5F0F1CB	42FE54AC6C58D67CDF4AF3E727F5D800BA33F6D2	1FC27D5091274C01DF8AE538DA538F41DC239069E9E830049B6543443CF1136F

Compliance

Source: update_390_391.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

System Summary

Source: update_390_391.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: clean0.winEXE@2/2@0/0

Source: C:\Users\user\Desktop\update_390_391.exe

File created: C:\Users\user\Desktop\ _avk_0.0.0.txt

Source: Yara match	File source: update_390_391.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1176732125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

Source: update_390_391.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\update_390_391.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\update_390_391.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\update_390_391.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\update_390_391.exe

File read: C:\Users\user\Desktop\update_390_391.exe

Source: unknown	Process created: C:\Users\user\Desktop\update_390_391.exe "C:\Users\user\Desktop\update_390_391.exe"
Source: unknown	Process created: C:\Users\user\Desktop\update_390_391.exe "C:\Users\user\Desktop\update_390_391.exe"

Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\update_390_391.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\update_390_391.exe

Window found: window name: TButton

Source: update_390_391.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: update_390_391.exe

Static file information: File size 28808560 > 1048576

Source: update_390_391.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x133800