Windows Analysis Report
EEghgCvQUy.exe

AI detected suspicious sample

Source: Yara match	File source: 00000000.00000003.1654659679.00007FF4FCAB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EEghgCvQUy.exe PID: 7436, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031D6FA0 CryptImportKey,		0_2_031D6FA0
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031D6FC0 CryptVerifySignatureW,		0_2_031D6FC0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_00413990 FindFirstFileW,FindClose,	0_2_00413990
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_02B95C90 FindFirstFileW,FindClose,	0_2_02B95C90
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_63086040 _errno,_errno,FindNextFileW,WideCharToMultiByte,calloc,calloc,MultiByteToWideChar,FindFirstFileW,free,free,free,_errno,malloc,strcpy,strlen,_errno,strcpy,strlen,free,free,_errno,_errno,WideCharToMultiByte,	0_2_63086040

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.4:49916 -> 104.194.143.5:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.4:49918 -> 172.86.76.246:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.4:49917 -> 104.194.148.11:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.4:49915 -> 172.86.76.246:443

Source: Joe Sandbox View	IP Address: 172.86.76.246 172.86.76.246
Source: Joe Sandbox View	IP Address: 104.194.148.11 104.194.148.11
Source: Joe Sandbox View	IP Address: 104.194.143.5 104.194.143.5

Source: Joe Sandbox View	ASN Name: M247GB M247GB
Source: Joe Sandbox View	ASN Name: PONYNETUS PONYNETUS
Source: Joe Sandbox View	ASN Name: PONYNETUS PONYNETUS

Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.143.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.148.11
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.76.246

Source: EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: EEghgCvQUy.exe, EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: EEghgCvQUy.exe, EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: EEghgCvQUy.exe	String found in binary or memory: http://www.openssl.org/
Source: EEghgCvQUy.exe, 00000000.00000002.3539806536.000000006E46B000.00000040.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3536220146.00000000632A0000.00000040.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000003.1662154280.00007FF4FCB1B000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000003.1659479540.00007FF4FCC5F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: EEghgCvQUy.exe, 00000000.00000003.1659479540.00007FF4FCC38000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3536220146.0000000063238000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: EEghgCvQUy.exe, 00000000.00000003.1659479540.00007FF4FCC38000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3536220146.0000000063238000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: EEghgCvQUy.exe, 00000000.00000002.3517531700.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: EEghgCvQUy.exe, 00000000.00000002.3517531700.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: EEghgCvQUy.exe, 00000000.00000002.3517531700.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_031DB300 GetSystemMetrics,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SetStretchBltMode,StretchBlt,DeleteObject,DeleteDC,GetDIBits,DeleteObject,ReleaseDC,DeleteDC,

0_2_031DB300

E-Banking Fraud

Source: Yara match	File source: 00000000.00000003.1654659679.00007FF4FCAB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EEghgCvQUy.exe PID: 7436, type: MEMORYSTR

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_031D6FA0 CryptImportKey,

0_2_031D6FA0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_00413460	0_2_00413460
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031DC1E0	0_2_031DC1E0
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_02B95760	0_2_02B95760
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_03206FE0	0_2_03206FE0
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031DBD10	0_2_031DBD10
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031E0270	0_2_031E0270
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_02D06720	0_2_02D06720
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031F2B80	0_2_031F2B80
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_02BCC870	0_2_02BCC870
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_03194830	0_2_03194830
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_02BB4990	0_2_02BB4990
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031E5F80	0_2_031E5F80
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031F1EC0	0_2_031F1EC0
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_031AFD70	0_2_031AFD70
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_03137C90	0_2_03137C90
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_63089200	0_2_63089200
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_6308AA70	0_2_6308AA70
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_63086040	0_2_63086040
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_6308A050	0_2_6308A050
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_630820A0	0_2_630820A0
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_63087F40	0_2_63087F40
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_631D3E50	0_2_631D3E50
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_63163D80	0_2_63163D80

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: String function: 02B9E130 appears 31 times
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: String function: 031E3FC0 appears 413 times
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: String function: 02B900D0 appears 31 times
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: String function: 63082570 appears 87 times
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: String function: 03193F30 appears 40 times
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: String function: 6314AA90 appears 46 times
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: String function: 63082CB0 appears 41 times
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: String function: 02B8FF30 appears 236 times

Source: EEghgCvQUy.exe	Binary or memory string: OriginalFilename vs EEghgCvQUy.exe
Source: EEghgCvQUy.exe, 00000000.00000002.3539806536.000000006E46B000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs EEghgCvQUy.exe
Source: EEghgCvQUy.exe, 00000000.00000002.3536220146.00000000632A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs EEghgCvQUy.exe
Source: EEghgCvQUy.exe, 00000000.00000002.3533199806.000000000348E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs EEghgCvQUy.exe
Source: EEghgCvQUy.exe, 00000000.00000003.1662154280.00007FF4FCB1B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs EEghgCvQUy.exe
Source: EEghgCvQUy.exe, 00000000.00000003.1659479540.00007FF4FCC5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs EEghgCvQUy.exe

Source: classification engine

Classification label: mal92.phis.troj.spyw.evad.winEXE@1/8@0/3

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_031371A0 StartServiceCtrlDispatcherW,

0_2_031371A0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_031371A0 StartServiceCtrlDispatcherW,

0_2_031371A0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

File created: C:\Users\user\AppData\Local\Temp\Aawrtreroswwe

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: EEghgCvQUy.exe, EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: EEghgCvQUy.exe, EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: EEghgCvQUy.exe, EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: EEghgCvQUy.exe, 00000000.00000003.1734316736.0000000004550000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: EEghgCvQUy.exe

ReversingLabs: Detection: 44%

Source: EEghgCvQUy.exe	String found in binary or memory: t xml:space=.gif" border="0"</body> </html> overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script> /favicon.ico" />operating system" style="width:1target="_blank">State Universitytext-align:left; document.write(, including the around t
Source: EEghgCvQUy.exe	String found in binary or memory: set-addPolicy
Source: EEghgCvQUy.exe	String found in binary or memory: -addr
Source: EEghgCvQUy.exe	String found in binary or memory: -start
Source: EEghgCvQUy.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

May use the Tor software to hide its network traffic

Source: EEghgCvQUy.exe

Static file information: File size 3536896 > 1048576

Source: EEghgCvQUy.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x35ee00

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_004032AA push rax; retf

0_2_004032B7

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_031371A0 StartServiceCtrlDispatcherW,

0_2_031371A0

Hooking and other Techniques for Hiding and Protection

Source: EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000003.1654387427.00007FF4FC980000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter

Source: C:\Users\user\Desktop\EEghgCvQUy.exe TID: 7556	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe TID: 7560	Thread sleep time: -52000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe TID: 7564	Thread sleep time: -75075s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_00413990 FindFirstFileW,FindClose,	0_2_00413990
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_02B95C90 FindFirstFileW,FindClose,	0_2_02B95C90
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: 0_2_63086040 _errno,_errno,FindNextFileW,WideCharToMultiByte,calloc,calloc,MultiByteToWideChar,FindFirstFileW,free,free,free,_errno,malloc,strcpy,strlen,_errno,strcpy,strlen,free,free,_errno,_errno,WideCharToMultiByte,	0_2_63086040

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_004163D0 GetSystemInfo,

0_2_004163D0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Thread delayed: delay time: 75075

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: EEghgCvQUy.exe, 00000000.00000002.3517531700.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_031E3CA0 VirtualAlloc,VirtualAlloc,GetProcessHeap,VirtualFree,GetNativeSystemInfo,VirtualAlloc,

0_2_031E3CA0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_031E48B0 GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,AllocateAndInitializeSid,EqualSid,FreeSid,

0_2_031E48B0

Source: EEghgCvQUy.exe, 00000000.00000003.1654188859.00007FF4FC890000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32
Source: EEghgCvQUy.exe	Binary or memory string: Shell_TrayWnd
Source: EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000003.1654659679.00007FF4FCAB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_02E024F0 cpuid

0_2_02E024F0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	0_2_00413B40
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00412BF0
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_02B94EF0
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	0_2_02B95E40

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_02BB8CF0 GetLocalTime,

0_2_02BB8CF0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_031E4AB0 GetTimeZoneInformation,

0_2_031E4AB0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Code function: 0_2_004128B0 RtlInitializeCriticalSection,GetVersion,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,

0_2_004128B0

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 00000000.00000003.1654659679.00007FF4FCAB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EEghgCvQUy.exe PID: 7436, type: MEMORYSTR

Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\EEghgCvQUy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\Desktop\EEghgCvQUy.exe

File opened: C:\Users\user\AppData\Roaming\Miranda\

Source: Yara match	File source: 00000000.00000003.1654188859.00007FF4FC890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EEghgCvQUy.exe PID: 7436, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000000.00000003.1654659679.00007FF4FCAB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EEghgCvQUy.exe PID: 7436, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	3 Windows Service	3 Windows Service	21 Obfuscated Files or Information	1 Credentials in Registry	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	Logon Script (Windows)	1 Process Injection	1 Software Packing	1 Credentials In Files	76 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	121 Virtualization/Sandbox Evasion	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Process Injection	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EEghgCvQUy.exe	45%	ReversingLabs	Win64.Trojan.SpywareX
EEghgCvQUy.exe	100%	Avira	TR/AVI.Agent.ozton

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://html4/loose.dtd	EEghgCvQUy.exe, EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.openssl.org/support/faq.htmlRAND	EEghgCvQUy.exe, 00000000.00000003.1659479540.00007FF4FCC38000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3536220146.0000000063238000.00000040.00001000.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.openssl.org/V	EEghgCvQUy.exe, 00000000.00000002.3539806536.000000006E46B000.00000040.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3536220146.00000000632A0000.00000040.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000003.1662154280.00007FF4FCB1B000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000003.1659479540.00007FF4FCC5F000.00000004.00001000.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.openssl.org/	EEghgCvQUy.exe	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://.css	EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://.jpg	EEghgCvQUy.exe, EEghgCvQUy.exe, 00000000.00000003.1656064470.00007FF4FC31D000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3523023859.0000000002B81000.00000040.00001000.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	EEghgCvQUy.exe, 00000000.00000003.1733668096.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.openssl.org/support/faq.html	EEghgCvQUy.exe, 00000000.00000003.1659479540.00007FF4FCC38000.00000004.00001000.00020000.00000000.sdmp, EEghgCvQUy.exe, 00000000.00000002.3536220146.0000000063238000.00000040.00001000.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.86.76.246	unknown	United States	9009	M247GB	true
104.194.148.11	unknown	United States	53667	PONYNETUS	true
104.194.143.5	unknown	United States	53667	PONYNETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565800
Start date and time:	2024-11-30 20:59:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EEghgCvQUy.exe renamed because original name is a hash value
Original Sample Name:	e3ef14a268039e14d8e20d2cddf143fb437dd4ac2caa450d179d6903fe513eac.exe
Detection:	MAL
Classification:	mal92.phis.troj.spyw.evad.winEXE@1/8@0/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: EEghgCvQUy.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.86.76.246	3yb52PgwJ2.exe	Get hash	malicious	DanaBot	Browse
	danabot.exe	Get hash	malicious	DanaBot	Browse
	danabot.exe	Get hash	malicious	DanaBot	Browse
	u26bBpzXS5.exe	Get hash	malicious	DanaBot	Browse
	u26bBpzXS5.exe	Get hash	malicious	DanaBot	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
104.194.148.11	3yb52PgwJ2.exe	Get hash	malicious	DanaBot	Browse
	danabot.exe	Get hash	malicious	DanaBot	Browse
	danabot.exe	Get hash	malicious	DanaBot	Browse
	u26bBpzXS5.exe	Get hash	malicious	DanaBot	Browse
	u26bBpzXS5.exe	Get hash	malicious	DanaBot	Browse
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
104.194.143.5	3yb52PgwJ2.exe	Get hash	malicious	DanaBot	Browse
	danabot.exe	Get hash	malicious	DanaBot	Browse
	danabot.exe	Get hash	malicious	DanaBot	Browse
	u26bBpzXS5.exe	Get hash	malicious	DanaBot	Browse
	u26bBpzXS5.exe	Get hash	malicious	DanaBot	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PONYNETUS	3yb52PgwJ2.exe	Get hash	malicious	DanaBot	Browse	104.194.143.5
	hmips.elf	Get hash	malicious	Unknown	Browse	209.141.49.186
	ppc.elf	Get hash	malicious	Unknown	Browse	205.185.114.79
	mips.elf	Get hash	malicious	Unknown	Browse	209.141.44.226
	arm7.elf	Get hash	malicious	Unknown	Browse	209.141.44.226
	x86.elf	Get hash	malicious	Unknown	Browse	209.141.49.186
	AD6dpKQm7n.exe	Get hash	malicious	Unknown	Browse	107.189.5.7
	NfFibKKmiz.exe	Get hash	malicious	Unknown	Browse	107.189.8.65
	harm5.elf	Get hash	malicious	Unknown	Browse	205.185.114.79
PONYNETUS	3yb52PgwJ2.exe	Get hash	malicious	DanaBot	Browse	104.194.143.5
	hmips.elf	Get hash	malicious	Unknown	Browse	209.141.49.186
	ppc.elf	Get hash	malicious	Unknown	Browse	205.185.114.79
	mips.elf	Get hash	malicious	Unknown	Browse	209.141.44.226
	arm7.elf	Get hash	malicious	Unknown	Browse	209.141.44.226
	x86.elf	Get hash	malicious	Unknown	Browse	209.141.49.186
	AD6dpKQm7n.exe	Get hash	malicious	Unknown	Browse	107.189.5.7
	NfFibKKmiz.exe	Get hash	malicious	Unknown	Browse	107.189.8.65
	harm5.elf	Get hash	malicious	Unknown	Browse	205.185.114.79
M247GB	3yb52PgwJ2.exe	Get hash	malicious	DanaBot	Browse	172.86.76.246
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	38.206.46.20
	sora.mips.elf	Get hash	malicious	Mirai	Browse	46.102.180.201
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	38.202.83.248
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	192.230.38.195
	newtpp.exe	Get hash	malicious	Xmrig	Browse	91.202.233.141
	SKM_BH450i2411261138090453854974574748668683985857435.scr.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	104.250.180.178
	#U4f73#U5ddd#U7acb 20241202 KAOHSIUNG-MANILA NORTH PORT 1x20' SO.scr.exe	Get hash	malicious	PureLog Stealer, Remcos	Browse	104.250.180.178
	LM94OE0VNK.exe	Get hash	malicious	Unknown	Browse	91.202.233.141

Process:	C:\Users\user\Desktop\EEghgCvQUy.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	E6FF930C3FB6DE61F664581C1A85F60C
SHA1:	F447CB15945D8630CC88ED3B7BEE049B6F5E4C7D
SHA-256:	CAA961E702D561D3245D06BF54FB5FE35BF75037032D764EC11FCB5AC1D41C1C
SHA-512:	60CA902E544D9535BC0F596EE8D262CAA73C885750875623DE20B42FAD52189C0CF41225312FC50DDB0C4D52580094A79F69CC8C674DC3200A42A935190DFFF8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ehaurtdq

Process:	C:\Users\user\Desktop\EEghgCvQUy.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	E6FF930C3FB6DE61F664581C1A85F60C
SHA1:	F447CB15945D8630CC88ED3B7BEE049B6F5E4C7D
SHA-256:	CAA961E702D561D3245D06BF54FB5FE35BF75037032D764EC11FCB5AC1D41C1C
SHA-512:	60CA902E544D9535BC0F596EE8D262CAA73C885750875623DE20B42FAD52189C0CF41225312FC50DDB0C4D52580094A79F69CC8C674DC3200A42A935190DFFF8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Eqsepootsafhfsy

Process:	C:\Users\user\Desktop\EEghgCvQUy.exe
File Type:	data
Category:	modified
Size (bytes):	28672
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CF845A781C107EC1346E849C9DD1B7E8
SHA1:	B44CCC7F7D519352422E59EE8B0BDBAC881768A7
SHA-256:	18619B678A5C207A971A0AA931604F48162E307C57ECDEC450D5F095FE9F32C7
SHA-512:	4802861EA06DC7FB85229A3C8F04E707A084F1BA516510C6F269821B33C8EE4EBF495258FE5BEE4850668A5AAC1A45F0EDF51580DA13B7EE160A29D067C67612
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ofeeyayqrtuo

Process:	C:\Users\user\Desktop\EEghgCvQUy.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0A9156C4E3C48EF827980639C4D1E263
SHA1:	9F13A523321C66208E90D45F87FA0CD9B370E111
SHA-256:	3A3ED164E42500A1C5B2D0093F0A813D27DC50D038F330CC100A7E70ECE2E6E4
SHA-512:	8A46C1B44C0EA338AFF0D2E2D07C34430B67B68B6D27E1ADB8CF216B0F0994172CED106A90283F2F0469B5CAA40ACEDF101D45729B823E5179EA55AC507E04AD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ofeeyayqrtuo-shm

Process:	C:\Users\user\Desktop\EEghgCvQUy.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qtapqhetueryfe

Process:	C:\Users\user\Desktop\EEghgCvQUy.exe
File Type:	data
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	F4F35D60B3CC18AAA6D8D92F0CD3708A
SHA1:	6FECD5769C727E137B7580AE3B1823B06EE6F9D9
SHA-256:	2AAE7DC846AAF25F1CADF55F1666862046C6DB9D65D84BDC07FA039DAC405606
SHA-512:	A69E2DCE2F75771C63ACDA51E4AEECC95B00F65377E3026BAF93A6CFB936BF6F10CB320CC09B0E43EB7833D062B24EFC5932569A1826E55DBB736CCDA0BEB413
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Srheqie

Process:	C:\Users\user\Desktop\EEghgCvQUy.exe
File Type:	data
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	76B973F7B910A22256212C63ADB7A103
SHA1:	2EAB7B3CF42E12BA5F1FF6AB512E4A105740F631
SHA-256:	96C94D0826105FE47C587FD79E8869CE5EDBFBACDDDAB9F4F30C5FECBA2CA6A3
SHA-512:	4C11351FE96BA26070E1B22230AA940BAFD2AA646960ED7A512F7398DAFE6FA2C029FE941F7EBF2C27C9D64957DC05DF66F5DB4365A9A8C6556216314FC12E95
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Yuftsyida