Edit tour

Windows Analysis Report
cloudflare.msi

Overview

General Information

Sample name:	cloudflare.msi
Analysis ID:	1573183
MD5:	5d2922491b47e1c355103194e069e5ac
SHA1:	eb918f926c9cc2f9239f1dfe0380727c8170982c
SHA256:	c348002e3d2cf40a2fc3c819a96b1735dc451bb3ec32ba9355feaccd3eee63c0
Tags:	193-188-22-40msiuser-JAMESWT_MHT
Infos:

Detection

DanaBot

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected DanaBot stealer dll

AI detected suspicious sample

May use the Tor software to hide its network traffic

PE file has a writeable .text section

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 3052 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cloudflare.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1424 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

AudioReaderXL.exe (PID: 884 cmdline: "C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe" MD5: 5D8A546C266CC1D2F14B3BE5C662C67A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social usering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: AudioReaderXL.exe PID: 884	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: AudioReaderXL.exe PID: 884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AudioReaderXL.exe PID: 884	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.AudioReaderXL.exe.88f0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.AudioReaderXL.exe.88f0000.3.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
3.2.AudioReaderXL.exe.88f0000.3.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32cfaa:$f1: FileZilla\recentservers.xml 0x32cf66:$f2: FileZilla\sitemanager.xml 0x3584e8:$b1: Chrome\User Data\ 0x35ef60:$b1: Chrome\User Data\ 0x35fa7c:$b1: Chrome\User Data\ 0x33f738:$b2: Mozilla\Firefox\Profiles 0x353420:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x37e19c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x351e0a:$b4: Opera Software\Opera Stable\Login Data 0x3585b8:$b5: YandexBrowser\User Data\ 0x370e4e:$s5: account.cfn 0x3512e8:$s6: wand.dat 0x350d9c:$a1: username_value 0x35735c:$a1: username_value 0x35762c:$a1: username_value 0x359ae0:$a1: username_value 0x350dc8:$a2: password_value 0x3573b4:$a2: password_value 0x357684:$a2: password_value 0x359b38:$a2: password_value 0x35abdc:$a3: encryptedUsername

Sigma Signatures

System Summary

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe, ProcessId: 884, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Advanced Chart Manager

Suricata Signatures

ET MALWARE Danabot Key Exchange Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:19:20.342255+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.6	49985	193.188.22.40	443	TCP
2024-12-11T16:19:21.429638+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.6	49988	193.188.22.41	443	TCP
2024-12-11T16:19:22.638957+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.6	49992	89.116.191.177	443	TCP
2024-12-11T16:19:23.715965+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.6	49995	213.210.13.4	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected DanaBot stealer dll

Source: Yara match	File source: 3.2.AudioReaderXL.exe.88f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AudioReaderXL.exe PID: 884, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D11A000.00000002.00000001.01000000.00000006.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_0ff52850-8

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License-Russian.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License.txt			Jump to behavior

Source:

Binary string: C:\Projects\.Secondary\NotificationsDemo\Win64\Release\Notifications.pdb source: Notifications,1.dll.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.6:49985 -> 193.188.22.40:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.6:49988 -> 193.188.22.41:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.6:49992 -> 89.116.191.177:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.6:49995 -> 213.210.13.4:443

Source: global traffic

TCP traffic: 192.168.2.6:49887 -> 8.8.8.8:53

Source: Joe Sandbox View	ASN Name: LRTC-ASLT LRTC-ASLT
Source: Joe Sandbox View	ASN Name: EDGEtaGCIComGB EDGEtaGCIComGB
Source: Joe Sandbox View	ASN Name: LIVECOMM-ASRespublikanskayastr3k6RU LIVECOMM-ASRespublikanskayastr3k6RU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177

Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: http://docs.opengeospatial.org/as/18-005r5/18-005r5.html#34
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: http://docs.opengeospatial.org/as/18-005r5/18-005r5.html#34The
Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: http://opengis.net/def/crs
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: http://opengis.net/def/crshttps://opengis.net/def/crshttp://www.opengis.net/def/crshttps://www.openg
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Notifications,1.dll.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.DelphiFFmpeg.com
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.DelphiFFmpeg.comSV
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.google.de
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.com/products/audio-reader-xl/videos/create-mp3.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.com/products/audio-reader-xl/videos/project-management.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.com/products/audio-reader-xl/videos/read-aloud-text.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.com/products/audio-reader-xl/videos/select-voice.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.com/products/audio-reader-xl/videos/settings.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.com/products/m_en_audio-reader-xl.html
Source: AudioReaderXL.exe, 00000003.00000002.3504321247.0000000002850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mediakg.com/products/m_en_audio-reader-xl.htmlR
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XL
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XLS
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XLU
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&produkt=Vorleser%20XL
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=1&produkt=Audio%20Reader%20XL
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/products/ebooktomp3/videos/einstellungen.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/products/ebooktomp3/videos/mp3.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/products/ebooktomp3/videos/projekt.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/products/ebooktomp3/videos/stimme.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/products/ebooktomp3/videos/stimme.htmlU
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/products/ebooktomp3/videos/vorlesen.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/products/m_ge_text-vorlesen-lassen.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/register/ebooktomp3_german.html
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.mediakg.de/register/order1.php?l=1&prog=ebook&lsv=false
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: http://www.opengis.net/def/crs
Source: AudioReaderXL.exe, 00000003.00000002.3527253406.0000000063469000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2979002736.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2980668020.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3548280979.000000006E66F000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: AudioReaderXL.exe, 00000003.00000003.2977578868.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3527253406.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: AudioReaderXL.exe, 00000003.00000003.2977578868.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3527253406.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: https://cdn.proj.org/
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/blog/files-inspector-activation.htm
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/blog/how-to-uninstall-files-inspector.htm
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/contact.htm
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/downloads.htm
Source: AudioReaderXL.exe, 00000003.00000003.2328207725.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/key-exchange.php?OldKey=%s&App=%s
Source: AudioReaderXL.exe, 00000003.00000003.2328207725.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/key-recover.htm
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/license.htm?doc=privacy
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/license.htm?doc=terms
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/like.htm
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/previous-versions.htm
Source: AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	String found in binary or memory: https://chemtable.ru/ru/files-inspector.htm
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D11A000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D11A000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D11A000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: AudioReaderXL.exe, 00000003.00000002.3510306998.0000000007A30000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3500175085.000000000072D000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3507530427.0000000003A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: AudioReaderXL.exe, 00000003.00000002.3507530427.0000000003A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: AudioReaderXL.exe, 00000003.00000002.3507530427.0000000003A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=10330
Source: AudioReaderXL.exe, 00000003.00000002.3500175085.000000000075F000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3500175085.00000000006CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: https://opengis.net/def/crs
Source: jdefend.dll.2.dr	String found in binary or memory: https://proj.org/resource_files.html
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: https://proj.org/schemas/v0.7/projjson.schema.json
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: https://proj.org/schemas/v0.7/projjson.schema.jsonmm0.001millimetrecm0.01centimetre1.0meter0.3048foo
Source: AudioReaderXL.exe, 00000003.00000002.3548061316.000000006E542000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://secure.r-tt.com/UserConsole.shtml
Source: AudioReaderXL.exe, 00000003.00000002.3548061316.000000006E542000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://secure.r-tt.com/cgi-bin/Store?id=513https://secure.r-tt.com/cgi-bin/Store?ID=513https://www.
Source: Russian.sib.2.dr	String found in binary or memory: https://theroadtodelphi.com
Source: Russian.sib.2.dr	String found in binary or memory: https://www.flaticon.com/authors/pavel-kozlov
Source: Russian.sib.2.dr	String found in binary or memory: https://www.flaticon.com/free-icon/right-arrow_566025
Source: Notifications,1.dll.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/search?q=%22sapi
Source: AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.de/search?q=%22sapi
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	String found in binary or memory: https://www.opengis.net/def/crs
Source: AudioReaderXL.exe, 00000003.00000002.3547012590.000000006D269000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.rebex.net/H

Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: Yara match

File source: Process Memory Space: AudioReaderXL.exe PID: 884, type: MEMORYSTR

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 3.2.AudioReaderXL.exe.88f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AudioReaderXL.exe PID: 884, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.AudioReaderXL.exe.88f0000.3.unpack, type: UNPACKEDPE

Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

PE file has a writeable .text section

Source: RwcProxy.dll.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\47502a.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI553B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\47502c.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\47502c.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\47502c.msi

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8A8CB0	3_2_6C8A8CB0
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8A6CC0	3_2_6C8A6CC0
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C88CCD0	3_2_6C88CCD0
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C89ACD0	3_2_6C89ACD0
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8A5C00	3_2_6C8A5C00
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8D1C20	3_2_6C8D1C20
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8A9C30	3_2_6C8A9C30
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8AED80	3_2_6C8AED80
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8B9DA0	3_2_6C8B9DA0
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8DDDA0	3_2_6C8DDDA0
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C89EDE0	3_2_6C89EDE0
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8B4D30	3_2_6C8B4D30
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8B7E80	3_2_6C8B7E80
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_6C8A4EB0	3_2_6C8A4EB0

Source: VclStylesinno.dll.2.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: 3.2.AudioReaderXL.exe.88f0000.3.unpack, type: UNPACKEDPE

Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: .VbPx

Source: classification engine

Classification label: mal84.troj.spyw.evad.winMSI@4/53@0/5

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Code function: 3_2_00B440E8 CoCreateInstance,CoCreateInstance,

3_2_00B440E8

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML5589.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Mutant created: \Sessions\1\BaseNamedObjects\vorleserxl
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Mutant created: \Sessions\1\BaseNamedObjects\62085327

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF3C732E24B520FB0D.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	Binary or memory string: CREATE TABLE properties( url TEXT PRIMARY KEY NOT NULL, lastChecked TIMESTAMP NOT NULL, fileSize INTEGER NOT NULL, lastModified TEXT, etag TEXT);CREATE TABLE downloaded_file_properties( url TEXT PRIMARY KEY NOT NULL, lastChecked TIMESTAMP NOT NULL, fileSize INTEGER NOT NULL, lastModified TEXT, etag TEXT);CREATE TABLE chunk_data( id INTEGER PRIMARY KEY AUTOINCREMENT CHECK (id > 0), data BLOB NOT NULL);CREATE TABLE chunks( id INTEGER PRIMARY KEY AUTOINCREMENT CHECK (id > 0), url TEXT NOT NULL, offset INTEGER NOT NULL, data_id INTEGER NOT NULL, data_size INTEGER NOT NULL, CONSTRAINT fk_chunks_url FOREIGN KEY (url) REFERENCES properties(url), CONSTRAINT fk_chunks_data FOREIGN KEY (data_id) REFERENCES chunk_data(id));CREATE INDEX idx_chunks ON chunks(url, offset);CREATE TABLE linked_chunks( id INTEGER PRIMARY KEY AUTOINCREMENT CHECK (id > 0), chunk_id INTEGER NOT NULL, prev INTEGER, next INTEGER, CONSTRAINT fk_links_chunkid FOREIGN KEY (chunk_id) REFERENCES chunks(id), CONSTRAINT fk_links_prev FOREIGN KEY (prev) REFERENCES linked_chunks(id), CONSTRAINT fk_links_next FOREIGN KEY (next) REFERENCES linked_chunks(id));CREATE INDEX idx_linked_chunks_chunk_id ON linked_chunks(chunk_id);CREATE TABLE linked_chunks_head_tail( head INTEGER, tail INTEGER, CONSTRAINT lht_head FOREIGN KEY (head) REFERENCES linked_chunks(id), CONSTRAINT lht_tail FOREIGN KEY (tail) REFERENCES linked_chunks(id));INSERT INTO linked_chunks_head_tail VALUES (NULL, NULL);
Source: AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: AudioReaderXL.exe, 00000003.00000003.3017821149.0000000009229000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510306998.0000000007A30000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.3021384227.0000000009228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: cloudflare.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%

Source: AudioReaderXL.exe

String found in binary or memory: %%QuickPDFLibrary-Start

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cloudflare.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe "C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe "C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: sapidll.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: pdftext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: jdefend.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: abcpdf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: rwcproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: cloudflare.msi

Static file information: File size 14462976 > 1048576

Source:

Binary string: C:\Projects\.Secondary\NotificationsDemo\Win64\Release\Notifications.pdb source: Notifications,1.dll.2.dr

Source: PDFtext.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x1446fe
Source: RwcProxy.dll.2.dr	Static PE information: real checksum: 0x5b597 should be: 0x63597
Source: VclStylesinno.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x301b55
Source: SAPIDLL.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x6f5d8
Source: ABCpdf.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0xb2a6e

Source: CloseApplication.dll.2.dr	Static PE information: section name: .didata
Source: VclStylesinno.dll.2.dr	Static PE information: section name: .didata
Source: gdiplus.dll.2.dr	Static PE information: section name: Shared

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_00B41954 push 00B419E1h; ret	3_2_00B419D9
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_00B0E0A0 push 00B0E0D8h; ret	3_2_00B0E0D0
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_00B1C0C4 push 00B1C139h; ret	3_2_00B1C131
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: 3_2_00B0E1F0 push 00B0E21Ch; ret	3_2_00B0E214

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WinRTApps,1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WinRTApps,2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\PDFtext.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\VclStylesinno.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CloseApplication.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\RwcProxy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\gdiplus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\SAPIDLL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\jdefend.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\ABCpdf.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License-Russian.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License.txt			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Advanced Chart Manager			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Advanced Chart Manager			Jump to behavior

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Binary or memory string: torConnect

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Window / User API: threadDelayed 1443			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Window / User API: threadDelayed 741			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WinRTApps,1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WinRTApps,2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\VclStylesinno.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CloseApplication.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\gdiplus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,2.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe TID: 5036	Thread sleep time: -72150s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe TID: 3004	Thread sleep time: -75075s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe TID: 1476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe TID: 3248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Thread delayed: delay time: 75075			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: AudioReaderXL.exe, 00000003.00000002.3500175085.0000000000766000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD9}
Source: cloudflare.msi	Binary or memory string: *VMci

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	API call chain: ExitProcess graph end node			graph_3-6579
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	API call chain: ExitProcess graph end node			graph_3-7081

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Code function: 3_2_6C8BBC68 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_6C8BBC68

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe "C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe"

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Code function: 3_2_6C8BBC68 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_6C8BBC68

Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,		3_2_00AF5858
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Code function: GetLocaleInfoA,		3_2_00AF61BC

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Code function: 3_2_6C8BBDE3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_6C8BBDE3

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Code function: 3_2_00B41954 GetVersion,

3_2_00B41954

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DanaBot stealer dll

Source: Yara match	File source: 3.2.AudioReaderXL.exe.88f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AudioReaderXL.exe PID: 884, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 3.2.AudioReaderXL.exe.88f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AudioReaderXL.exe PID: 884, type: MEMORYSTR

Remote Access Functionality

Yara detected DanaBot stealer dll

Source: Yara match	File source: 3.2.AudioReaderXL.exe.88f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AudioReaderXL.exe PID: 884, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	2 Process Injection	1 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Data from Local System	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Process Injection	DCSync	131 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cloudflare.msi	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\ABCpdf.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CloseApplication.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\PDFtext.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\RwcProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\SAPIDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\VclStylesinno.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WinRTApps,1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WinRTApps,2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\gdiplus.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\jdefend.dll	5%	ReversingLabs

Source	Detection	Scanner	Label
https://www.opengis.net/def/crs	0%	Avira URL Cloud	safe
http://www.mediakg.de/products/ebooktomp3/videos/mp3.html	0%	Avira URL Cloud	safe
http://www.mediakg.com/products/audio-reader-xl/videos/select-voice.html	0%	Avira URL Cloud	safe
http://www.mediakg.com/products/m_en_audio-reader-xl.html	0%	Avira URL Cloud	safe
http://www.mediakg.de/products/ebooktomp3/videos/einstellungen.html	0%	Avira URL Cloud	safe
https://secure.r-tt.com/UserConsole.shtml	0%	Avira URL Cloud	safe
https://chemtable.ru/previous-versions.htm	0%	Avira URL Cloud	safe
https://chemtable.ru/license.htm?doc=terms	0%	Avira URL Cloud	safe
http://www.mediakg.de/products/ebooktomp3/videos/vorlesen.html	0%	Avira URL Cloud	safe
https://proj.org/schemas/v0.7/projjson.schema.jsonmm0.001millimetrecm0.01centimetre1.0meter0.3048foo	0%	Avira URL Cloud	safe
http://www.mediakg.com/products/m_en_audio-reader-xl.htmlR	0%	Avira URL Cloud	safe
http://www.mediakg.com/products/audio-reader-xl/videos/project-management.html	0%	Avira URL Cloud	safe
https://chemtable.ru/key-exchange.php?OldKey=%s&App=%s	0%	Avira URL Cloud	safe
https://secure.r-tt.com/cgi-bin/Store?id=513https://secure.r-tt.com/cgi-bin/Store?ID=513https://www.	0%	Avira URL Cloud	safe
https://theroadtodelphi.com	0%	Avira URL Cloud	safe
https://chemtable.ru/downloads.htm	0%	Avira URL Cloud	safe
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XL	0%	Avira URL Cloud	safe
http://www.DelphiFFmpeg.comSV	0%	Avira URL Cloud	safe
https://proj.org/schemas/v0.7/projjson.schema.json	0%	Avira URL Cloud	safe
https://chemtable.ru/ru/files-inspector.htm	0%	Avira URL Cloud	safe
https://www.rebex.net/H	0%	Avira URL Cloud	safe
https://cdn.proj.org/	0%	Avira URL Cloud	safe
https://proj.org/resource_files.html	0%	Avira URL Cloud	safe
http://opengis.net/def/crs	0%	Avira URL Cloud	safe
http://www.opengis.net/def/crs	0%	Avira URL Cloud	safe
http://www.mediakg.de/products/ebooktomp3/videos/projekt.html	0%	Avira URL Cloud	safe
http://docs.opengeospatial.org/as/18-005r5/18-005r5.html#34	0%	Avira URL Cloud	safe
https://opengis.net/def/crs	0%	Avira URL Cloud	safe
http://docs.opengeospatial.org/as/18-005r5/18-005r5.html#34The	0%	Avira URL Cloud	safe
http://www.DelphiFFmpeg.com	0%	Avira URL Cloud	safe
https://chemtable.ru/license.htm?doc=privacy	0%	Avira URL Cloud	safe
http://www.mediakg.de/products/m_ge_text-vorlesen-lassen.html	0%	Avira URL Cloud	safe
https://chemtable.ru/like.htm	0%	Avira URL Cloud	safe
http://opengis.net/def/crshttps://opengis.net/def/crshttp://www.opengis.net/def/crshttps://www.openg	0%	Avira URL Cloud	safe
http://www.mediakg.com/products/audio-reader-xl/videos/create-mp3.html	0%	Avira URL Cloud	safe
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&produkt=Vorleser%20XL	0%	Avira URL Cloud	safe
https://chemtable.ru/blog/how-to-uninstall-files-inspector.htm	0%	Avira URL Cloud	safe
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=1&produkt=Audio%20Reader%20XL	0%	Avira URL Cloud	safe
https://chemtable.ru/key-recover.htm	0%	Avira URL Cloud	safe
http://www.mediakg.com/products/audio-reader-xl/videos/read-aloud-text.html	0%	Avira URL Cloud	safe
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XLS	0%	Avira URL Cloud	safe
http://www.mediakg.de/register/order1.php?l=1&prog=ebook&lsv=false	0%	Avira URL Cloud	safe
https://chemtable.ru/blog/files-inspector-activation.htm	0%	Avira URL Cloud	safe
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XLU	0%	Avira URL Cloud	safe
http://www.mediakg.de/products/ebooktomp3/videos/stimme.htmlU	0%	Avira URL Cloud	safe
http://www.mediakg.de/products/ebooktomp3/videos/stimme.html	0%	Avira URL Cloud	safe
https://chemtable.ru/contact.htm	0%	Avira URL Cloud	safe
http://www.mediakg.de/register/ebooktomp3_german.html	0%	Avira URL Cloud	safe
http://www.mediakg.com/products/audio-reader-xl/videos/settings.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	false		high
https://chemtable.ru/license.htm?doc=terms	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/products/ebooktomp3/videos/mp3.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.flaticon.com/authors/pavel-kozlov	Russian.sib.2.dr	false		high
http://www.openssl.org/V	AudioReaderXL.exe, 00000003.00000002.3527253406.0000000063469000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2979002736.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2980668020.000000007EB20000.00000004.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3548280979.000000006E66F000.00000040.00001000.00020000.00000000.sdmp	false		high
https://secure.r-tt.com/UserConsole.shtml	AudioReaderXL.exe, 00000003.00000002.3548061316.000000006E542000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.com/products/audio-reader-xl/videos/select-voice.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.com/products/m_en_audio-reader-xl.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/products/ebooktomp3/videos/vorlesen.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://proj.org/schemas/v0.7/projjson.schema.jsonmm0.001millimetrecm0.01centimetre1.0meter0.3048foo	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=%22sapi	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
https://www.opengis.net/def/crs	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://.css	AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	false		high
https://www.google.de/search?q=%22sapi	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
http://www.mediakg.de/products/ebooktomp3/videos/einstellungen.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	AudioReaderXL.exe, 00000003.00000003.2977578868.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3527253406.0000000063281000.00000040.00001000.00020000.00000000.sdmp	false		high
https://chemtable.ru/previous-versions.htm	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.com/products/audio-reader-xl/videos/project-management.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D11A000.00000002.00000001.01000000.00000006.sdmp	false		high
http://www.google.de	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
http://www.mediakg.com/products/m_en_audio-reader-xl.htmlR	AudioReaderXL.exe, 00000003.00000002.3504321247.0000000002850000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.DelphiFFmpeg.comSV	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.r-tt.com/cgi-bin/Store?id=513https://secure.r-tt.com/cgi-bin/Store?ID=513https://www.	AudioReaderXL.exe, 00000003.00000002.3548061316.000000006E542000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://chemtable.ru/downloads.htm	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
https://chemtable.ru/key-exchange.php?OldKey=%s&App=%s	AudioReaderXL.exe, 00000003.00000003.2328207725.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
https://proj.org/schemas/v0.7/projjson.schema.json	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XL	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://chemtable.ru/ru/files-inspector.htm	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
http://.jpg	AudioReaderXL.exe, 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp	false		high
https://theroadtodelphi.com	Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
https://proj.org/resource_files.html	jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://www.rebex.net/H	AudioReaderXL.exe, 00000003.00000002.3547012590.000000006D269000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://opengis.net/def/crs	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://docs.opengeospatial.org/as/18-005r5/18-005r5.html#34The	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/products/ebooktomp3/videos/projekt.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.proj.org/	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D11A000.00000002.00000001.01000000.00000006.sdmp	false		high
https://opengis.net/def/crs	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://docs.opengeospatial.org/as/18-005r5/18-005r5.html#34	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.opengis.net/def/crs	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://www.flaticon.com/free-icon/right-arrow_566025	Russian.sib.2.dr	false		high
http://www.DelphiFFmpeg.com	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&produkt=Vorleser%20XL	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://chemtable.ru/license.htm?doc=privacy	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D11A000.00000002.00000001.01000000.00000006.sdmp	false		high
http://opengis.net/def/crshttps://opengis.net/def/crshttp://www.opengis.net/def/crshttps://www.openg	AudioReaderXL.exe, 00000003.00000002.3543383906.000000006D048000.00000002.00000001.01000000.00000006.sdmp, jdefend.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.com/products/audio-reader-xl/videos/create-mp3.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/products/m_ge_text-vorlesen-lassen.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://chemtable.ru/like.htm	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=1&produkt=Audio%20Reader%20XL	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.htmlRAND	AudioReaderXL.exe, 00000003.00000003.2977578868.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000002.3527253406.0000000063281000.00000040.00001000.00020000.00000000.sdmp	false		high
https://chemtable.ru/blog/how-to-uninstall-files-inspector.htm	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.com/products/audio-reader-xl/videos/read-aloud-text.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://chemtable.ru/key-recover.htm	AudioReaderXL.exe, 00000003.00000003.2328207725.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XLS	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/register/order1.php?l=1&prog=ebook&lsv=false	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://chemtable.ru/blog/files-inspector-activation.htm	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/products/ebooktomp3/videos/stimme.htmlU	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/products/ebooktomp3/videos/stimme.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/contact/m_ge_contact.php?gr=technik&l=0&cdrom=1&produkt=Vorleser%20XLU	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://chemtable.ru/contact.htm	AudioReaderXL.exe, 00000003.00000003.2327793560.0000000000796000.00000004.00000020.00020000.00000000.sdmp, Russian.sib.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mediakg.de/register/ebooktomp3_german.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mediakg.com/products/audio-reader-xl/videos/settings.html	AudioReaderXL.exe, 00000003.00000000.2275487417.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
89.116.191.177	unknown	Lithuania	15419	LRTC-ASLT	true
213.210.13.4	unknown	United Kingdom	8851	EDGEtaGCIComGB	true
193.188.22.40	unknown	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true
193.188.22.41	unknown	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573183
Start date and time:	2024-12-11 16:16:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cloudflare.msi
Detection:	MAL
Classification:	mal84.troj.spyw.evad.winMSI@4/53@0/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 23.206.197.11, 20.109.210.53
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: cloudflare.msi

Simulations

Behavior and APIs

Time	Type	Description
10:18:02	API Interceptor	1220x Sleep call for process: AudioReaderXL.exe modified
16:19:25	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Advanced Chart Manager C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.116.191.177	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse
213.210.13.4	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse
193.188.22.40	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	discord.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	Document.xla	Get hash	malicious	Unknown	Browse	13.107.246.63
	Message_2713712.eml	Get hash	malicious	Unknown	Browse	13.107.246.63
	FreebieNotes.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	13.107.246.63
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	13.107.246.63
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://www.officested.com/eur/14cb4ab4-62b8-45a2-a944-e225383ee1f9/bbd2fe64-a7e1-4036-87ed-fa296dec6eb4/3966c028-c5bc-45c3-932e-642ccbdd8bca/login?id=Zjc0eUxaVU1jVElZSFBZVWJoQXgrZGErVWw5TzBLNllUbTV2WGJKbjRIbk00VFJpTUxwZzJJWnZ2dnBXZjVyYldlWk9NOTQ4WGViVXUzUkI3TmFGdXhRQU9kWDdUUlFXRnlMaUdhZWVuVE9tdnc5bjFNaWs1M1ozTkRnUldwUHdHQ2gzNmRGTDZUM0pkbVExc2Vxa05lWExvQU5WZTFibEpLeXJwM0RIYWJKUjkrWlBZNU5DRUFuTzc0dEZVb2tyOUlxMkVRK0pHSEllMFZLZkJTSXorK2Nady9WcmlFRUJVRkFZRXFrRkhmQ3pPTktuS2djQkVyQ2krUWpEZGlBY2ZCUi9neElRTFVINExCdkNIeVc1bXROSlNLaW9YYUlkWGZ4aFVDSVlIME5VMjY5MUQwRzd1cXBsSEpsZWYyR0pWaUdVdi9wZ3pHckJoK3FCNDRxN3huQzhhVXY5WU5PcWpoRDdDU3FZUWtUWDg2amJyWjQ0ZHhhOGprZGZUU0czOWhHaEFjZnhCR0JRdGlzVUp5ZVJqSmtSOWtvRE90VWp2SWJMb1VUNWpvTT0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	Purchase order docs..exe	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIVECOMM-ASRespublikanskayastr3k6RU	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse	193.188.22.40
	http://winningwriters.com	Get hash	malicious	Unknown	Browse	193.188.22.73
	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	92.246.89.93
	cHZiG7fsJb.exe	Get hash	malicious	Metasploit	Browse	212.192.213.56
	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	92.246.89.93
	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	92.246.89.93
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
LRTC-ASLT	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse	89.116.191.177
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	89.117.100.57
	ET5.exe	Get hash	malicious	Unknown	Browse	89.117.55.228
	b1.exe	Get hash	malicious	PureCrypter, MicroClip	Browse	89.117.79.31
	b1.exe	Get hash	malicious	PureCrypter, MicroClip	Browse	89.117.79.31
	mipsel.elf	Get hash	malicious	Unknown	Browse	84.46.252.91
	aeI0ukq9TD.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	0ylPF4c3eF.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	0ylPF4c3eF.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
	aeI0ukq9TD.exe	Get hash	malicious	Unknown	Browse	89.117.72.231
EDGEtaGCIComGB	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	185.49.126.73
	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	185.49.126.73
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	213.210.9.89
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	77.107.70.202
	fvIqrxcfuL.exe	Get hash	malicious	Quasar	Browse	89.213.56.109
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	89.213.146.12
	arm7.elf	Get hash	malicious	Unknown	Browse	77.107.120.22
	JnC2t6WhUf.elf	Get hash	malicious	Mirai	Browse	213.130.144.69
	mhmdm9Hb6i.elf	Get hash	malicious	Mirai	Browse	213.130.144.69

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	12995
Entropy (8bit):	5.776122125171664
Encrypted:	false
SSDEEP:	192:Me8c4QDjYe0lIfIhIfKWIrJnETn0ayhcp4:MqsIaISDrJZay9
MD5:	FE0441EF65C06C996CDBCF773E4CA697
SHA1:	4DD4F34D3D50E45D67A575DDFEF12025038B4D3F
SHA-256:	A86C96EE19F589EB48B6E0DB35E5E2EAD635F10B7DD4ADF9BFC82952D6A1FD6E
SHA-512:	DDF92706C58CE3AAB5135371E315C19BD35C85F9FFE577DDC6BD6BFED51DACF88F8250E7A613570EC617DD1CF6E72FC06B3814CC76D30AA849C042F8E6B8F401
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@,R.Y.@.....@.....@.....@.....@.....@......&.{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}..Audio Reader XL Premium..cloudflare.msi.@.....@.....@.....@........&.{F42B81C2-97E3-4FE6-BB7D-FDC864EFC273}.....@.....@.....@.....@.......@.....@.....@.......@......Audio Reader XL Premium......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{69ACFB11-8974-7600-BE76-FB33A2985E33}&.{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}.@......&.{73617013-F5DE-07AB-793A-5A906368C1DE}&.{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}.@......&.{EB597F34-5CA9-86B7-A290-3FD80E69853C}&.{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}.@......&.{7C63DA7D-A151-8DE2-2017-642FB5D89B29}&.{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}.@......&.{5A8AEE58-FA25-376B-5210-F176A92468D2}&.{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}.@......&.{69D5A7EB-BC0A-D266-A8B3-317BF6CF77A5}&.{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}.@......&.{0D67F12E-BF10-693F-7E5A-F6371E5AC

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\ABCpdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	668160
Entropy (8bit):	6.740452679312067
Encrypted:	false
SSDEEP:	12288:p2TYCjcIOrbbz7z7z9dkvF4KfcQnbHVoVTX23sgCxYPwtZ81+b+vUIqlzDG:MTYCj7OH9dPQnbHVeTXOsgCxYPwfhsU9
MD5:	F35E190D9847AEE93157AD18BEE2FF51
SHA1:	011DD903705AC60F39A74191B41B82C11C53ABE6
SHA-256:	FAF2B98EF2934C7ADDF7056A3B6F2FA56C814DB79D960F8FB2744E4E4D260500
SHA-512:	F4329B5BED3A840E1E630BE9A5A61903D2AAE31D6FAC068D6F750B98A0D2B65DE9B38DB1DDD6298C104704D48593996BC7DB8F6E6D77F1117BFC8E0431935738
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........m..>..>..>...?..>...?d..>...?..>.2.?..>.2.?..>.2.?..>..>..>D2.?~..>F2.?..>D2.?..>...?..>..>...>F2.?..>F2.?..>F2.>..>F2.?..>Rich..>........PE..L...e.Pg...........!........Z..............................................p............@.........................@...P.......P....0.......................@...(......................................@...............`............................text...\|........................... ..`.rdata..............................@..@.data...............................@....rsrc........0......................@..@.reloc...(...@.....................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2364872
Entropy (8bit):	6.379046969425799
Encrypted:	false
SSDEEP:	24576:Wie/PVMysxcKuyHA1k7XTOS6waIrBmSNMddjftjQXcWrdr20cI1CtQEsdi7BAEws:WieFNZUMWBr20XMrsdiOi/dL
MD5:	5D8A546C266CC1D2F14B3BE5C662C67A
SHA1:	A474FE2BF3311A452BEE640DBB423B20E0A99929
SHA-256:	8EAEFF4697CE489DAEE3D82E7C703409907BFB9FA890A3646B56634798E01BC4
SHA-512:	CDD3C8C4A73CCF10D97097826E5B4567D0A3B227A9080E3FF7AD84EEC6276A11C94A47F545D2B6023ED6A3B4B377D2073E6584B2CE4492F1DE7789A7FA6C2CCA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................P............... ....@...........................%.....Z.%..........@..............................\|3.......B............#..+..........................................................................................CODE................................ ..`DATA.....`... ...b..................@...BSS..................r...................idata..\|3.......4...r..............@....tls.....................................rdata..............................@..P.reloc..hu..........................@..P.rsrc....B.......B..................@..P..............%......`%.............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CharcoalDarkSlate.vsf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	60560
Entropy (8bit):	7.942670786996824
Encrypted:	false
SSDEEP:	1536:brbl0jMTaIITC/tApjVrGPUUKhUBlE8q6bKPfYyBUgTZ3H1YMwZxwrpNZ:brbG5TS6p5rgUUfrE8qHVYMaqd
MD5:	947023BA00312C4574A44688A11FD5EB
SHA1:	164A4609C041D93CCB645AB8DF70E04FFB984508
SHA-256:	AA45E23296396E41E3F1547EE8AA59989F2EE3E05651F27B842ECA366C87F047
SHA-512:	A6AF49BA6E12B886BD30217A7AE5856881F553A4931ACDA2AE26E372FB79AFC09ECF0A6364011ADCDF2E2F93D76899A23570F00DB2DCE9D5C06A1A9C24B5C66D
Malicious:	false
Reputation:	low
Preview:	VCL_STYLE 1.0x..........(.Q1."........l.....A *;......F\....o2....d....2.K2...7.qW4....i.v...9...<....=.TWU......:6....\....6si...0.23..~..o..>'.,3?s.9.s.c......3s...d....[f&...5.-2...^...lYj..7..5.c.W......:...:.,....,]6...[8...M.O..5...\f.9\|.I...a.e2[.... .. .. .. .. .. .. .. ..Pfh.C.. .....:..C...A3>..mo.O}....p>.........M..:.w..C.9......:8.~r..v....>{..x...}6.]l..K..M.g.#.8.C.9..c.;.#....A..4.;.SN9..s..~.Yg...QG...i.G...3.<.E....-Nz....&..<....\|....v<.9..9...\.../.G>./..?.<l.\|q..]n.....Ole..\|..gw9...4k..jx.[.E=.6?...L..H.{w.1.H]q...X{..?.8.\|5o.....3O=..s..;..<.\.r.w.q..\|..g..i.&<k..{>..?.f..[.t...1...;v.....@[.{.'.i...>...OoG......A....C..}?.....L.a..ywv..y.I'.4.;.9WZ.....o..i....Q.C....8..8?.. ?.O..'.%..rP..E......V.m.v.9.3..i6...7.'.r....c.N[.......].^.7lX>...F:.A..w.y..t.Ct..g........N.:..Ff.....3...../.a.#m..w..?.. ......&....;..Md.t.../9....s3...,..OD.K.yn..7.._.}.if_..?.t..<.3...3..k.y... ...l.y..5..a..m.5..i...{..Z..

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CloseApplication.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1077864
Entropy (8bit):	6.658605493439835
Encrypted:	false
SSDEEP:	12288:23hLkUYjhGQdM7oMM+aHfjSjPexymAprswNEsr:0h3uGQdM/M+aH7SjPexDrwNfr
MD5:	981EB6460FDE8A6456F55811AFDEF266
SHA1:	1A745E900F0ECDFD8F158C610F25CD5C38CF1D89
SHA-256:	F05248CAD953F87B0006633813DD4BF5A73B8012A2C777CD9746960BF4112DE0
SHA-512:	DB9A1488F0A3B88B86A17AD65E37AA75648346CDFD2CFCC4F0C49ADEB59E7C8FB7EAF30C26E670DB49E4CCC6C34FEBB11C62FC2E80C1FE1D967F7A62B1D9E147
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@......ujr......................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....!\...........#.....@...p...............P....@......................................................................................J...........N..h$...P...A..............................................................X....................text....@.......6.................. ..`.data....p...P...p...<..............@....tls................................@....idata..............................@..@.didata.............................@....edata..............................@..@

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Concept.dat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	5773700
Entropy (8bit):	7.999844991117473
Encrypted:	true
SSDEEP:	98304:6ZQF+FGaDvWpJDxvjReJGwufh41Gt+J2vuumYZnX0Ed4ghM8pFYLULa2:6yRfqSgJ2vhmYdEESg+DLk
MD5:	4035390AF4171153C1CB708F7151ED5F
SHA1:	9ED10AD504E6B19F6FD9570ED92A793BD2D79721
SHA-256:	407048F9D01E5BF9051A043261A29C4654190444FE15E5F96F97C446AD7AE8D3
SHA-512:	56C8942340B9D83C0C396AED680000E1A2C9A0F075CB8C96150D9341AEEF4A62245A373288CA0546C21605333DECA86DC2FD47812DE605BB3EAEB08B987E22C8
Malicious:	false
Reputation:	low
Preview:	..B.8..2.V. \.......................................1012546698.?=<>2! #kKWRTHFHO.HM-QPSSUTW.\X[[U\_^uvsvuupuMHKJLLON.usrt\|wvyNIJEILLVecbeegfi.njmmon..........v.........................]........................_.......................................................................................700?>=>;.1033547.<8;;5<?>HNWGWJFJ'(+,,/..USRT\WVYkbnlnnmrOCBEEGFI.NJMMGNqp........kz}\|~~a`.ged`nihkVmlon...........n..................................................................z................T........................5.N.a.e.w.t.y.j.\.q.e.p.m......103.3474.8;:.<O>S L"B$U&H(FI,N.%P2RpT.V,X(Z2\1^$@7B.D3F(H8J&LWNqpsrut.syx{z}\|.ga`czedg.lhkkglon............................................&..............................................i..........................." }&mm}rljkolyz&xe4p............0.325.O.X....].Z....C..@.....ik.cc`ee5.c.hl..ih@A@CZEDG.LHKKoLON%<!..3!..5:=.&42..&Z.R.,0.^_...?.............................................................I.............

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Insurance.db

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	5773922
Entropy (8bit):	7.999845070062444
Encrypted:	true
SSDEEP:	98304:dZQF+FGaDvWpJDxvjReJGwufh41Gt+J2vuumYZnX0Ed4ghM8pFYLULaJ:dyRfqSgJ2vhmYdEESg+DLT
MD5:	FF01238C5058B0A88937E6B66CEC3DEE
SHA1:	CBA788EED57AAF85926723EDC60EF44B93A21540
SHA-256:	13CA4BAA28A4E4CA78E2173C492D759AF5334BF5A1C86961FC5FC5A5B8970593
SHA-512:	5671EC102C7FE17F3BEFA8FF58EB9E82DF21283F025C759C926143B8FF74235A8B2D18742F0B618727CC104583D203900D3AE77AE6497E581A040474A83F6A13
Malicious:	false
Preview:	".......8...r...z..X................................1012546698.?=<>2! #kKWRTHFHO.HM-QPSSUTW.\X[[U\_^uvsvuupuMHKJLLON.usrt\|wvyNIJEILLVecbeegfi.njmmon..........v.........................]........................_.......................................................................................700?>=>;.1033547.<8;;5<?>HNWGWJFJ'(+,,/..USRT\WVYkbnlnnmrOCBEEGFI.NJMMGNqp........kz}\|~~a`.ged`nihkVmlon...........n..................................................................z................T........................5.N.a.e.w.t.y.j.\.q.e.p.m......103.3474.8;:.<O>S L"B$U&H(FI,N.%P2RpT.V,X(Z2\1^$@7B.D3F(H8J&LWNqpsrut.syx{z}\|.ga`czedg.lhkkglon............................................&..............................................i..........................." }&mm}rljkolyz&xe4p............0.325.O.X....].Z....C..@.....ik.cc`ee5.c.hl..ih@A@CZEDG.LHKKoLON%<!..3!..5:=.&42..&Z.R.,0.^_...?.............................................................I.............

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Languages\Russian.sib

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	128859
Entropy (8bit):	4.943003285603881
Encrypted:	false
SSDEEP:	3072:3JhvdFo00y4f24h3eqwO2tVj7AVeWmOgXls/o68MU3O7Ik4JTMIs0FiThxajjQXR:3NFo0yf24hOqwOqVjXPXs/o6c3O7bzIs
MD5:	4D7D38CA87590E1C4787D834312485FB
SHA1:	7114A6219F62149071E289FF171CB3A78DD43DD7
SHA-256:	BA8827D76C9682A3FBB548C1C392BD058C1CFDA1FD8654C715ABFBDAD750E9A0
SHA-512:	28680AC747344F770D6A724C27F3B5F073C5A0D159FFA620900042EF25433E46F45D3A4C803175A92051F1F10B67F32ED2C41DEB5B610F65E37BB41C701B2CD5
Malicious:	false
Preview:	SIB file: TsiLang binary translation data......TAboutForm>.....TApplicationsDeletedForml.....TApplicationsDidYouKnowTipsData....!.TApplicationsExternalDeleteModule.'....TApplicationsFrame"-....TApplicationsLogCreateForm.Q....TApplicationsLogNotationsForm.h....TApplicationsLogViewForm.p....TApplicationsRemovalToolsForm.... .TApplicationsRevertLogResultForm2.....TApplicationsUninstallForm......TBackgroundTasksModule......TCommonTextStringsDataModule......TDidYouKnowCenterForm.....TDidYouKnowCenterTipsData......TFilesAnalyzerGearModuleY...".TFilesInspectorDecreasePreviewForm......TFilesInspectorFinalDeleteFormM.....TFilesInspectorFrame....$.TFindAppUninstallKeyByFileDataModulec.....TForm30.!....TInterfaceHintsDataModule.%....TLicenseKeysDataModule.....TLicensingKeyEnteringForm......TLicensingNagScreenFormD;....TLicensingOldKeysForm.C..!.TLicensingSubscriptionExpiredFormoQ..".TLicensingSubscriptionReminderForm.[....TMainForm.b....TMultiLanguageSupportFormLp....TNonModaInformersDataModul

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License-Russian.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (754), with CRLF line terminators
Category:	dropped
Size (bytes):	4244
Entropy (8bit):	5.198711732329662
Encrypted:	false
SSDEEP:	96:ovTn1OPTlcUb+PsDJkb53evIhiy79L3NxLagU0tbTTE6:oxwYaIhF79L3DGp0tfTF
MD5:	3D44E666CE041981DBF7529916D4C92A
SHA1:	0D51862AE922CEBAA9638D542D6B4684E195A1A8
SHA-256:	62EDAD9E609781D9CC130B3DCB9AC27C7342F79F97BE295390C517251E98877B
SHA-512:	665E016A6956588CE761ACA0E11D9429164E05E471B8F9C7510B297DDF136B209EC112C6043AF5407F3EFFDDE3E09AC4BAA47548209C5C09F156E483D447016B
Malicious:	false
Preview:	.........., ........ ........... ............. ............ ....................... ............ .......... (.......) ........ ............ (......... .......) . ........ ....... . ... ............ ....... ............. .... (..... . ............ ... .........) ......... ... ... Files Inspector (..... .........). ..... ............ . ......... ........... ... "........... ....... 365" (..... . ............... ... .........) . .......... ................ ............. .... .. ......... ... ... Files Inspector, ....... ........... ............ . ... . ........ ./... ........... ...., ......... ............ ............ (........ .... ..... ....... ...) ................ ..... .. ............. ........., ............ ...... ........... . ....... ......... . ............ . .............. ......... ........... (.........) ......... . ......... (....... ................ ........).............. ....... ...... (............. ..........)............. ...... (............ ........../.......) ...

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	3227
Entropy (8bit):	4.572788431582577
Encrypted:	false
SSDEEP:	96:VIH8x2eRbTuhCal3ZHUT8zbEJnUE6njHpakfW1n/:kCfRbTk/ZHQUGH
MD5:	8C3D5DF72E234543B6619A38EA4C9915
SHA1:	42247B1B09814B174742D85A87E842AF096426C9
SHA-256:	3A5DDB81221D346B0A4F9DCBDCEFA7D63F38D4570D0C9B0627A7698094BA4356
SHA-512:	9F52D48261909BB151449DAC60EB5D74128FAB03E89C2E50EE9A872D263E0F4D27203FC898E4BA1E39510672DE6CA0CAEA0329640C78B639DA58DEFB1F18C225
Malicious:	false
Preview:	PLEASE READ THE FOLLOWING LICENSE AGREEMENT CAREFULLY.....This License Agreement is a legal agreement between you (either an individual or a single entity) and Software Solutions 365 LLC for software products identified above, which may include associated software components, media, printed materials, and "online" or electronic documentation ("Software"). By installing, copying, or otherwise using the Software, you agree to be bound by the terms of this Agreement. If you do not agree to the terms of this Agreement, do not install or use the Software.....1. Files Inspector....This program is free for personal and educational (including non-profit organization) use. In these cases, you are granted the right to use and to make an unlimited number of copies of this software.....This Software and any support from Software Solutions 365 LLC are provided "AS IS" and without warranty, express or implied. Software Solutions 365 LLC specifically disclaim any implied warranties of merchantability

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181416
Entropy (8bit):	6.072186773489314
Encrypted:	false
SSDEEP:	3072:jWXWWW055R79HkNoTkV7Az5qJsGrfM1HZwiKIcvrJVjT:jdwTENV0zHyl9x
MD5:	6FA8B90E42549E4FD2334D8EE1C58784
SHA1:	77850CEB975CFD1C1B4CD815129564982A92875C
SHA-256:	5E17FAF323F85570317C5C338999697C883BFEE6990A6EECC62F14347D03F38E
SHA-512:	89603D9D1393CC98189EB77F8DE88BDB55818CB5C932CA907772EDD0999B635DC23CE491418CF5C62A0DE68E5DFF316E44D8EE9E77825C22FEACCEFFDE495BCA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........6...e...e...e...d...e...dA..e...d...e...d...e...d...e...d...e.oe...e...d...e...e@..ea..d...ea..d...ea..e...ea..d...eRich...e................PE..d...G.Pd.........." .....N...R...........................................................`..........................................C..`...0D..................<........2..............p.......................(....................`...............................text....M.......N.................. ..`.rdata..V....`.......R..............@..@.data....7...`...&...F..............@....pdata..<............l..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149160
Entropy (8bit):	6.5780964327075395
Encrypted:	false
SSDEEP:	1536:VkLcRLzu+NvI1sUUQTtnZg66ytrAqXu+eo4bJv21sW/cd2esC9AolG5lV17AQF+3:KcRu+NVNQHg66yOqXuxeW2eAolZ8h7jE
MD5:	2076CBC974BB0BEB29D167C2B068EFB9
SHA1:	01CEEB0F9585B5ADC221EA6913A78CC8B930FE9D
SHA-256:	FA8D25A439C64F6916FBFA72A643FD2BE33D62BD196749D5D1E3E11655FE9508
SHA-512:	88B67CB38833CFB05747C8EA41F67F7C3EC74EE6DF6D1A9DD038C1FEA973919F6B561ED21C83AAFD419373970B23F8CA804AC58F65DE8F1952F215A8A0B19B43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$.a.w.a.w.a.w...v.a.w...vga.w...v.a.w...v.a.w...v.a.w...v.a.w..3w.a.w...v.a.w.a.w.a.wJ..v.a.wJ..v.a.wJ._w.a.wJ..v.a.wRich.a.w........PE..L....Pd...........!.....<...................P...............................P...... .....@.................................<........ ...................2...0..4.......p................... ...........@............P...............................text....;.......<.................. ..`.rdata.......P.......@..............@..@.data...p*....... ..................@....rsrc........ ......................@..@.reloc..4....0... ..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\PDFtext.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1299968
Entropy (8bit):	6.762310886008993
Encrypted:	false
SSDEEP:	24576:MmZhH1PZylAs19Y6BXln3EpRbrsjdb64dXtSaonb5JTsTkRHh+8:MsEYalr64dXtV4bITqH
MD5:	F5DD27918CDC45136567CEB8B216C5B8
SHA1:	D7DA1E100292AB7D6908516A60A555BE77B6D01E
SHA-256:	8A4C862FFDF0E858AE721BCE97E2A5951C4D8DD665856459C41378141F5F2772
SHA-512:	C1D2240DC168DF8CAD9355F5266093BABF0EAF257F40206A18F3364D0D3F2B1D03042241CEF8134DF06AA11CFB386F231EA48FA433801ACE68282BBE32D904BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...L.N.................X...z.......j.......p....@..........................p..........................................c....P.../...`...............................................................................X..\............................text....J.......L.................. ..`.itext.......`.......P.............. ..`.data....z...p...\|...\..............@....bss....\|V...............................idata.../...P...0..................@....edata..c...........................@..@.reloc..............................@..B.rsrc........`......................@..@.............p......................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\RwcProxy.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	344216
Entropy (8bit):	6.595173572062912
Encrypted:	false
SSDEEP:	6144:VT1JVXKs/zrLHInEkVFpCcE0rw24GpY3ctV0eIYYXAEcOdlsyL:TJVXf8HVFQ0k24GUbeQcOdlR
MD5:	741FD2623AD12DE3403F39EF575181E3
SHA1:	54F3FA29A9565278109BA6A4049F403970110C49
SHA-256:	1612B2DB97AA51736DE92BE6FC50C502394169ED4DC3E9BFDE06F331DD08790A
SHA-512:	045171C2F8B65A0CE41AC86680DBC2683C1561ED008A4F33C34874CDDEFB8F5B15AA7F402DC98386E7B37428FC7EA86325C19C2E3B1B91BC401FC1659F6B8705
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x..4<k.g<k.g<k.gw..f6k.gw..f.k.g(.f7k.gw..f=k.g..fk.g..f.k.g..f.k.gw..fk.gw..f=k.gw..f%k.g<k.g>j.g(.f.k.g(.f=k.g(.Jg=k.g<k"g=k.g(.f=k.gRich<k.g........PE..L...O.f...........!...(............zC....... ............................................@.............................d...T...........X................(......\0..p...................................@............ ...............................text............................... ....rdata....... ......................@..@.data...`...........................@....rsrc...X...........................@..@.reloc..\0.......2..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\SAPIDLL.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	413184
Entropy (8bit):	6.581871839232087
Encrypted:	false
SSDEEP:	6144:2auf0pjxP5h2ki1XSeuB3TaIM452S8Y0LS1mgRzj8Zt5ZSlG9+uzgHzUKl:qfIjxPvUXSeEs883Lz8jA/ZS5uzgZ
MD5:	7D96EBF6AB548AC4E9F6EE761454DE9F
SHA1:	CC121DB7480602A3E3A10CFC453F2604258805D2
SHA-256:	39C4355690759ADE7E5A645603C46C48FF83B0D47163FBF7FFE9EAA92DFAECAF
SHA-512:	B2BF462D11217C764A5071B2E84B18CFDBA778B48705AFBDE6E38F68DFF80F8FE9A8F3C0F27CC731EFA114E2DDD3A67219D79B289934C328D3820A2FE017A0DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................R...........a.......p....@.............................................................................l!...@...^......................L_..................................................................................CODE.... Q.......R.................. ..`DATA.........p.......V..............@...BSS.....a............j...................idata..l!......."...j..............@....edata..............................@..P.reloc..L_.......`..................@..P.rsrc....^...@...^..................@..P.....................N..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\ThemedTypesIgnore.xml.bkp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	322
Entropy (8bit):	4.923375810926379
Encrypted:	false
SSDEEP:	6:TMV0RmmAsQCMDmATDUCMDmA0ibCMDmA0iNIMDmA4cbCMDmAxMDmAKHIMo0:TMGRmmTFMDm8MDmFFMDmF2IMDm/MDmut
MD5:	DF00C215260AAA2D2B571005D38DEE66
SHA1:	A32C80F9023A9EFB2D23A0C9D2B67824F5DFE85C
SHA-256:	72D8C1C2D41160E27830AF8C48D49C8BB36CBCB03C4DCD0ECADA3E43BCEA31D8
SHA-512:	B15911C9A908758006200D31BC359611F3E6EB197CF98B61307680FEE1BCAD011BEB5D09B6E7FE4E14B31E00715950B1BA43E5AB26E43207F36C856E3B61CDDC
Malicious:	false
Preview:	<?xml version="1.0"?>..<Root>.. <Item>%FOLDERID_ProgramData%</Item>.. <Item>%FOLDERID_Windows%</Item>.. <Item>%FOLDERID_LocalAppData%</Item>.. <Item>%FOLDERID_LocalAppDataLow%</Item>.. <Item>%FOLDERID_RoamingAppData%</Item>.. <Item>%FOLDERID_ProgramFiles%</Item>.. <Item>%FOLDERID_ProgramFilesX86%</Item>..</Root>..

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\VclStylesinno.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3129856
Entropy (8bit):	6.692920115202363
Encrypted:	false
SSDEEP:	49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
MD5:	B0CA93CEB050A2FEFF0B19E65072BBB5
SHA1:	7EBBBBE2D2ACD8FD516F824338D254A33B69F08D
SHA-256:	0E93313F42084D804B9AC4BE53D844E549CFCAF19E6F276A3B0F82F01B9B2246
SHA-512:	37242423E62AF30179906660C6DBBADCA3DC2BA9E562F84315A69F3114765BC08E88321632843DBD78BA1728F8D1CE54A4EDFA3B96A9D13E540AEE895AE2D8E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....W..................)...........)...... )...@...........................1.......................................+......`+.f8...@/..T....................+..{..................................................`j+.......+......................text.....(.......(................. ..`.itext...,....(.......(............. ..`.data...d.... ).......).............@....bss....x.....).......)..................idata..f8...`+..:....).............@....didata.......+.......).............@....edata........+.......).............@..@.reloc...{....+..\|....).............@..B.rsrc....T...@/..T...n-.............@..@..............1......./.............@..@................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WhatsNew-Russian.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.790660863727601
Encrypted:	false
SSDEEP:	12:S1GigXIRp5nuIAoOjyCiQvg13vNIsQFDedsCpsiM0icl2GtuOZnE:S1GZW/RIvqjQNC1iclWoE
MD5:	622F3D0B51D18328020F858C77AC4A9C
SHA1:	84EC68B009C254FBCBF8D0FE38917E27EEE26392
SHA-256:	4F39DE7B48D8CD80F40267250DF737619C122C260E982CA64029CE6BBC852D95
SHA-512:	1F9712BE02005380A52806478EB316D9D9F212CEDFD7458EB337B9534823DDD5AD69E4F2D968D8CE8825286372A1DA90423A8EF0E0BBA6068DEAEEFF228656FA
Malicious:	false
Preview:	.. ... ...... . ......... ......... ------------------------------.......... .. Files Inspector 4.15.. --------------------.... * . ....... ........... (... ....... ............) ...... ..... ..... ....... .. .. ............ ..... ......... . ......... ........... * .......... ......... .. ......... .........., .............. . ...... ...... .. ......... ... ..... ....... .. ......... ........ ....... ........ . ......, .. ..... ........... .. ....... ......... ..... . .......... .... * .......... ...... . ....... "......... . ....": .... ........... ......... .. .. ..... "......... . ........." .. ....... (........) ......., ... .. ........... .. ..... ........... Files Inspector.......

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WhatsNew.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.376851114759592
Encrypted:	false
SSDEEP:	24:SECmCTHFMW0uu4UHqCq9CMXdNC+pjnR0bZ:SpmfruAzqQMSscZ
MD5:	26C76E66CF53CF7767F08C00E4659B09
SHA1:	0907744FE2D42EBB9B53BE23AD28DDDB256ACBD2
SHA-256:	5CBD87A6585C0BBC9904DFF390D98333C36DD7728FBB67ECE896BDD93ABFD066
SHA-512:	874746B34FE44BA42E3AEBB691B446AD6A8F7CEDA52CA35C99B2A06AB754E4538931EB3BB3D2BEB71196102BD1516A14DDFE9235F94BFD42D117C596A8129B39
Malicious:	false
Preview:	.. What's New in the Latest Version.. --------------------------------...... Files Inspector 4.15.. --------------------.... * In the notification section (under the bell icon), you can now .. find news from the official program blog and educational articles..... * Tooltips, which appear in different parts of the program to help .. users learn how to use it most effectively, have been improved. A .. close button and a button to respond to program requests directly .. within the tooltip have been added..... * Bug fixed in the Applications and Games section: If you move an .. application from the "System and Service" folder to the top (root) .. level, it does not stay there after you restart Files Inspector.........

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WinRTApps,1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	517760
Entropy (8bit):	6.211950186401596
Encrypted:	false
SSDEEP:	6144:Qw9R9eQz5CtIqB2rXx9pLPolyKaU/VWXrx/JWlT+NQljVdohHpaBOv/wEQqYn1Hl:/1Rz5ZrpglyedFTohpGOm1l
MD5:	F96606642F2747B1FD5F2C859E120472
SHA1:	7D97D001540575653C0A6C4806B210FBB85307BC
SHA-256:	3716685133159B8A0716987641B22BA90C7208A83EC18784C80B19ADB1789C95
SHA-512:	F86CB9E688C06C58DAB82CE778E099D0FBA55EBEE72688D3EF6510EFABFA22D5324BE60F0F6E3D4B5AB36001320861BE575B2B648DBEA7C6DC48E25A669ABDFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................z.........................1............O...D.....D.....D.]....D.....Rich...................PE..d...{IN^.........." ........."......................................................T.....`.........................................0...P........................B.......@..............p.......................(.......................`............................text............................... ..`.rdata...b.......d..................@..@.data....d... ...J..................@....pdata...B.......B...N..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\WinRTApps,2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431232
Entropy (8bit):	6.595644118947377
Encrypted:	false
SSDEEP:	12288:+i6uSO+hcBDS/60Q7eAPlw9zBrSS0nEe3sK4wk2G:DWcBDSYvlwLSSTe8K4wvG
MD5:	0E53CD8997AB346A4AF5B9D19BE1A98B
SHA1:	378ACC6333E975E5409E04074D2D1CF83C5FE619
SHA-256:	6113B459870B07AA3055E0EE645D6F3DDBE8E7931BB0ABCD3A9736F62561D1FF
SHA-512:	953DAAE2372CB29810BF1C879DD6459BE27C17466E8F615D20D39CE497584E536D66F8956467C50A23734561FBD8CDB22CADF5AC5C28F76FBED4D26CEFB2FFB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........6...e...e...e...d...e...dp..e...d...e...d...e...d...e...d...e..e...e...d...e...e^..eO..d...eO..d...eO.ge...eO..d...eRich...e........................PE..L......]...........!.....F..........hr.......`......................................:.....@.............................P...@........0...............T...@...@...F..0K..p...................@L.......K..@............`.. ............................text....E.......F.................. ..`.rdata...}...`...~...J..............@..@.data....O.......B..................@....rsrc........0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\eBooks\Meal.wav

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	1911886
Entropy (8bit):	7.559298207966295
Encrypted:	false
SSDEEP:	49152:DfN77nrR+8A7m+QMXouCi8/n4FbpijxXNnk68mktXl:DfN77U7m+nouCdf4oNn9kv
MD5:	1ADB1764E42021F4049B1AE9F2E1D614
SHA1:	813DF01FF0A7562F1D0A02AB1F60F3F60435ABD4
SHA-256:	88183AFFE3E1FEB95C8B9F55B2D4A63BCBD1E8B40B901EC01BDCAA15A6D442A1
SHA-512:	E3D4F0EFB59A7F77B5940A0A3C26AEC5A5E879DC42F951376BB6C5E4184F137BD624D766C10B6315294860CB0B7113FF2FD6B4D09C89B4F9421B73705DD5E647
Malicious:	false
Preview:	RIFFF,..WAVEfmt ........D...........LIST....INFOISFT....Lavf57.83.100.data.,..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.!.<.<.2.2.:.:././.;.;.....:.:.-.-.;.;...8.8.'.'.6.6.'.'.6.6.&.&.6.6.(.(...............................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\gdiplus.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1729832
Entropy (8bit):	6.747423032766495
Encrypted:	false
SSDEEP:	24576:giHQhZy6MotzRTX4UTKaSxEV+y0MTxpcep1jSa0GDBkHWRobqUT:giwDyMdrTWx+YElnjSUuHLqUT
MD5:	52AA4A2F1187B461C97F4A9AE6C6C54D
SHA1:	DC2EA68AB7C69DD7EE6C47178C6CF5B65C7A087A
SHA-256:	830C39D0063BA9B96B997BAB43D48C5A2D82E83754BB16EA1DB820A4FCF215DE
SHA-512:	C748D75DF1F07A74FBC49B7DF425ECD3260BE5A29B0C5CB7EE79B6B25C92A82D1B8911EBBBDFAB2F0C756F4B70D1434C807A6370DA96AF7551A3196F40C985F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z..>..mm..mm..mm.0m..mm..lmK.mm.bm..mm.2m.mm.1m..mm.3m..mm..m..mm.7m..mmRich..mm........................PE..L...C..H...........!.........`......m..............J.........................`.......................................2..CN......x....................P..(........x......8...............................@...............D............................text...j........................... ..`.data..............................@...Shared..............................@....rsrc............ ..................@..@.reloc...x..........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\jdefend.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9116352
Entropy (8bit):	6.747641159297999
Encrypted:	false
SSDEEP:	196608:7TX1m7a8USvrHfag5HFUFUXSk0zGrfCXv9GKbTK8mZWvqOME:7xm9UamgdFUFUXSk0zGrfCXv4KbTujOx
MD5:	BA095598CFFB424C202781656CA2F2A7
SHA1:	013486F84ABA2A89955C6A62DEF2FD9524DBA151
SHA-256:	F7B8D216B27FA51D835D262EE55FBD836D08B4F413E42BAD38DEA658F1779AED
SHA-512:	687223DA11C8E0507A57B8480421400CBC44476EE94407E3601A8797E86449F95BF72CE47520071816523B40377509A27CFBDAB29EAC7C97F68C4411A852229C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$............tzO.tzO.tzO..yN.tzO...NntzO..~N.tzO..O.tzO..yN.tzO..~N.tzO...N.tzO.tzO.tzO1.~N.wzO3..N.tzO1..N.uzO..\|N.tzO..{N.tzO.t{O.uzO3.sN.tzO3.zN.tzO3.O.tzO3.xN.tzORich.tzO........PE..L...x.Pg...........!...*.dq..j.......o^.......q...........................................@.............................................................H.......5..................................P~..@.............q..............................text....cq......dq................. ..`.rdata........q......hq.............@..@.data... Q...0......................@....rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\links.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255
Entropy (8bit):	4.923451311843341
Encrypted:	false
SSDEEP:	3:vFWWMNHUzRZtcfVWDSLjXPQig6WiJ7kNfCq2RK9C+LbTEK9gDL4vHpQig6WgQMfo:TMV0RZtc0OLjXtOq7kEL+qDL4P/OgQEu
MD5:	A09CD34D7B0C5D9855E09181C6DD72E8
SHA1:	D6B1FA061C69BC773922336824ED8B6040B9690C
SHA-256:	C7B45450BF29B9E7DBCE2B7EBC0583875EDD233180EECA698B2B681C5DA9200D
SHA-512:	B6AF8CD55D1361E248091E4DE08A13F6DEABAA5E129AEF6A29F161916682AB8A9133955E418BCDA0E79CDD053F0872C0D1B2525E5FAFA275F431886D88580EA1
Malicious:	false
Preview:	<?xml version="1.0"?>..<Root><Default>https://www.chemtable.com/order_files_inspector_online.htm</Default><LocalizedLinks><Languages><Item>Russian</Item></Languages><URL>https://chemtable.ru/order_files_inspector_online.htm</URL></LocalizedLinks></Root>..

C:\Users\user\AppData\Local\Temp\Efeeedsf

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	DAA100DF6E6711906B61C9AB5AA16032
SHA1:	963FF6C2D517D188014D2EF3682C4797888E6D26
SHA-256:	CC61635DA46B2C9974335EA37E0B5FD660A5C8A42A89B271FA7EC2AC4B8B26F6
SHA-512:	548FAEE346D6C5700BB37D3D44B593E3C343CA7DC6B564F6D3DC7BD5463FBB925765D9C6EA3065BF19F3CCF7B2E1CB5C34C908057C60B62BE866D2566C0B9393
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hhdryao

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	E6FF930C3FB6DE61F664581C1A85F60C
SHA1:	F447CB15945D8630CC88ED3B7BEE049B6F5E4C7D
SHA-256:	CAA961E702D561D3245D06BF54FB5FE35BF75037032D764EC11FCB5AC1D41C1C
SHA-512:	60CA902E544D9535BC0F596EE8D262CAA73C885750875623DE20B42FAD52189C0CF41225312FC50DDB0C4D52580094A79F69CC8C674DC3200A42A935190DFFF8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Itefhqeafir

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	E6FF930C3FB6DE61F664581C1A85F60C
SHA1:	F447CB15945D8630CC88ED3B7BEE049B6F5E4C7D
SHA-256:	CAA961E702D561D3245D06BF54FB5FE35BF75037032D764EC11FCB5AC1D41C1C
SHA-512:	60CA902E544D9535BC0F596EE8D262CAA73C885750875623DE20B42FAD52189C0CF41225312FC50DDB0C4D52580094A79F69CC8C674DC3200A42A935190DFFF8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Odherippqeip

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF235F22DF3E004EDE21041978C24F2E
SHA1:	7188972F71AEE4C62669330FF7776E48094B4D9D
SHA-256:	16FA66A7DC98D93F2A4C5D20BAF5177F59C4C37FC62FACE65690C11C15FE6FF9
SHA-512:	E76D7CBBAA2B3110D38425F7B579C6F94C29A162D3B4A3B9A4FEACEDE7CEC5EA5E30E455F9417A2C230390C78AB2FBC54C7B98C8F8F68955FE071C37C59D4046
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Reedsqspduarequ

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	E6FF930C3FB6DE61F664581C1A85F60C
SHA1:	F447CB15945D8630CC88ED3B7BEE049B6F5E4C7D
SHA-256:	CAA961E702D561D3245D06BF54FB5FE35BF75037032D764EC11FCB5AC1D41C1C
SHA-512:	60CA902E544D9535BC0F596EE8D262CAA73C885750875623DE20B42FAD52189C0CF41225312FC50DDB0C4D52580094A79F69CC8C674DC3200A42A935190DFFF8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Shwarfd

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	modified
Size (bytes):	98304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0A9156C4E3C48EF827980639C4D1E263
SHA1:	9F13A523321C66208E90D45F87FA0CD9B370E111
SHA-256:	3A3ED164E42500A1C5B2D0093F0A813D27DC50D038F330CC100A7E70ECE2E6E4
SHA-512:	8A46C1B44C0EA338AFF0D2E2D07C34430B67B68B6D27E1ADB8CF216B0F0994172CED106A90283F2F0469B5CAA40ACEDF101D45729B823E5179EA55AC507E04AD
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Shwarfd-shm

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Steqqehqwsssiao

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	AB893875D697A3145AF5EED5309BEE26
SHA1:	C90116149196CBF74FFB453ECB3B12945372EBFA
SHA-256:	02B1C2234680617802901A77EAE606AD02E4DDB4282CCBC60061EAC5B2D90BBA
SHA-512:	6B65C0A1956CE18DF2D271205F53274D2905C803D059A0801BF8331CCAA28A1D4842D3585DD9C2B01502A4BE6664BDE2E965B15FCFEC981E85EED37C595CD6BC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tpqppdyitteqpi

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	EF2E0D18474B2151EF5876B1E89C2F1D
SHA1:	AEF9802FCF76C67D695BC77322BAE5400D3BBE82
SHA-256:	3381DE4CA9F3A477F25989DFC8B744E7916046B7AA369F61A9A2F7DC0963EC9E
SHA-512:	E81185705A3BD73645BF2B190BBF3AEE060C1C72F98FA39665F254A755B0A5723CE8296422874EB50C7B5E8D6BCD90175B0BA28061221039172A3F50E8902CC8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tuoyiteiuq

Download File

Process:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
File Type:	data
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	DAA100DF6E6711906B61C9AB5AA16032
SHA1:	963FF6C2D517D188014D2EF3682C4797888E6D26
SHA-256:	CC61635DA46B2C9974335EA37E0B5FD660A5C8A42A89B271FA7EC2AC4B8B26F6
SHA-512:	548FAEE346D6C5700BB37D3D44B593E3C343CA7DC6B564F6D3DC7BD5463FBB925765D9C6EA3065BF19F3CCF7B2E1CB5C34C908057C60B62BE866D2566C0B9393
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\47502a.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Audio Reader XL Premium, Author: IN MEDIAKG TI, Keywords: Installer, Comments: This installer database contains the logic and data required to install Audio Reader XL Premium., Template: Intel;1033, Revision Number: {F42B81C2-97E3-4FE6-BB7D-FDC864EFC273}, Create Time/Date: Wed Dec 4 21:17:08 2024, Last Saved Time/Date: Wed Dec 4 21:17:08 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	14462976
Entropy (8bit):	7.995795486374199
Encrypted:	true
SSDEEP:	393216:GDFCbAjiImi73v4JPUQ6Rm1feeuQx1qbvto:GRCbAjCK6PEm12ZQx1qbFo
MD5:	5D2922491B47E1C355103194E069E5AC
SHA1:	EB918F926C9CC2F9239F1DFE0380727C8170982C
SHA-256:	C348002E3D2CF40A2FC3C819A96B1735DC451BB3EC32BA9355FEACCD3EEE63C0
SHA-512:	522BE674A5FB20AF9A4FA42315AE8E780DF3310F5B0EA8FECCCA1CF788CD6AF542226AED65E9C6F7353D2DAF954522F4067880626A2CCF4B7793178B57EB0BD9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\47502c.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Audio Reader XL Premium, Author: IN MEDIAKG TI, Keywords: Installer, Comments: This installer database contains the logic and data required to install Audio Reader XL Premium., Template: Intel;1033, Revision Number: {F42B81C2-97E3-4FE6-BB7D-FDC864EFC273}, Create Time/Date: Wed Dec 4 21:17:08 2024, Last Saved Time/Date: Wed Dec 4 21:17:08 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	14462976
Entropy (8bit):	7.995795486374199
Encrypted:	true
SSDEEP:	393216:GDFCbAjiImi73v4JPUQ6Rm1feeuQx1qbvto:GRCbAjCK6PEm12ZQx1qbFo
MD5:	5D2922491B47E1C355103194E069E5AC
SHA1:	EB918F926C9CC2F9239F1DFE0380727C8170982C
SHA-256:	C348002E3D2CF40A2FC3C819A96B1735DC451BB3EC32BA9355FEACCD3EEE63C0
SHA-512:	522BE674A5FB20AF9A4FA42315AE8E780DF3310F5B0EA8FECCCA1CF788CD6AF542226AED65E9C6F7353D2DAF954522F4067880626A2CCF4B7793178B57EB0BD9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI553B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	9543
Entropy (8bit):	5.759994998005076
Encrypted:	false
SSDEEP:	192:de88YRZVrgHlNodjZj50Vb6elJnETnHW4z:dTXgFNGjUV/JeWg
MD5:	1588E2256ADBAA04ED8B6C7B1C92ACF0
SHA1:	BB208766A4B3A217CDB19E2C40095975E1582AC6
SHA-256:	7D5DF727C8EABF09974EEBFD893ECB729B457CF32F1B77A808F91F7FAEBC1A8B
SHA-512:	A743DA5704BE9ADF35840E4ADA4A0C8D38C12E17D254A8297FB171BFDEA66CBB8C21C76D3AD72B13D1CCFE579E2A19C9D38E32561F806D9E6C237602034314A0
Malicious:	false
Preview:	...@IXOS.@.....@,R.Y.@.....@.....@.....@.....@.....@......&.{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}..Audio Reader XL Premium..cloudflare.msi.@.....@.....@.....@........&.{F42B81C2-97E3-4FE6-BB7D-FDC864EFC273}.....@.....@.....@.....@.......@.....@.....@.......@......Audio Reader XL Premium......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{69ACFB11-8974-7600-BE76-FB33A2985E33}V.C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CharcoalDarkSlate.vsf.@.......@.....@.....@......&.{73617013-F5DE-07AB-793A-5A906368C1DE}U.C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CloseApplication.dll.@.......@.....@.....@......&.{EB597F34-5CA9-86B7-A290-3FD80E69853C}T.C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License-Russian.txt.@.......@.....@.....@......&.{7C63DA7D-A151-8DE2-2017-642FB5D89B29}L.C:\Users\user\A

C:\Windows\Installer\SourceHash{67D76A46-417D-40B2-AC02-DA0F92C8DB7A}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1639010927641986
Encrypted:	false
SSDEEP:	12:JSbX72FjaSAGiLIlHVRpZh/7777777777777777777777777vDHFLzit/l0i8Q:JPQI5tMiF
MD5:	C534B68C7405112599FB0DC712F4952B
SHA1:	ABC147A891EC472FC97EC1CDDE4CB95CCA03C7DD
SHA-256:	28B657D11B4BB3BDD98324511A34DD4312454BC2BA74AAD9AF8BDA83423B6C29
SHA-512:	4FB33FD39A6B3B86D09B389C3D2300C2F16A92AB103DD9142B7A3FA8A04AA19B18E3C0CCBC27B5B80347E3AE1D6297BB938021E9CC97C5C88F49B13749C6FF55
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5060591360020226
Encrypted:	false
SSDEEP:	48:48PhiuRc06WXJSFT5yzucG1B0S50rlcG1B0SIRB:Hhi1JFT+HY
MD5:	A9F64934AFBAFBE2500170B52541B6BD
SHA1:	EA71AC68A6D2C510B10890CBA84A21E8A89D9D74
SHA-256:	B831F939F66EF059C89546525AF41DDCFA017A790D3EB936AAD200567A9E71E8
SHA-512:	1BF8C7FB396C0F42F0130643A70E6D49E3D1B851937697BFD37D9B2F51B34A77BD531B80928DAAAD8DA9D345711E376E407531D344E97D6B589FA1C706AF4D72
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.3629855524246794
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaux:zTtbmkExhMJCIpEs
MD5:	7565435661CA5615860CBA2F91AE54D4
SHA1:	5145BF12380F6AD321DB13CB2F6ABDD2A4C969FA
SHA-256:	B9ABEEFBBDCCB00747D2068E6990058E8E5E103EDEAC358661841F2B1042270C
SHA-512:	78C6AFF934FE8A7C21A5E065E8FEBFA731B7B2E3202BEFC9BF5E20422A6A915265F8A8366F643CEEF1A00D747D2E535D0751F772516E53494218CD74DCDEFBC3
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF0193DB89DC99C9AF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3C732E24B520FB0D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12114843681218518
Encrypted:	false
SSDEEP:	24:iHeBwY8OwVWG0eBwbipVkwVWG0eBwbipV7VgwG7Plrkgq+6:dBMLcG1B0SLcG1B0S50rqb
MD5:	DAF50F5D2945EA9213F91F780A262811
SHA1:	28B7DACFAEC904CE7B09175797FD88FDC9F595D9
SHA-256:	FE298CE918D31E6E37F75BBB3C89AAD00C011D613EB181FC073E6E598AB1E671
SHA-512:	22235D98FA4305B1713210859DAD6073863A57F41673FAD41A6E3D0650B842F4A3C532DAC3B224BFEEBEBD9E8071AA14FEDAE294F327557DA7700E3034A52EEE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF481F87A370138D0C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5A044599A54808E7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF63E48DD65B4168CC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5060591360020226
Encrypted:	false
SSDEEP:	48:48PhiuRc06WXJSFT5yzucG1B0S50rlcG1B0SIRB:Hhi1JFT+HY
MD5:	A9F64934AFBAFBE2500170B52541B6BD
SHA1:	EA71AC68A6D2C510B10890CBA84A21E8A89D9D74
SHA-256:	B831F939F66EF059C89546525AF41DDCFA017A790D3EB936AAD200567A9E71E8
SHA-512:	1BF8C7FB396C0F42F0130643A70E6D49E3D1B851937697BFD37D9B2F51B34A77BD531B80928DAAAD8DA9D345711E376E407531D344E97D6B589FA1C706AF4D72
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8893FE8018619F61.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2105748413563577
Encrypted:	false
SSDEEP:	48:q9quIPveFXJjT58zucG1B0S50rlcG1B0SIRB:Oq47TkHY
MD5:	C6E7AEE9E064CB6C796EF2C250122335
SHA1:	FE86E682981F352EF4D9D90681C59BD5D8EF8F3A
SHA-256:	720E712E71074B22B407D1DA828EF1D7D49C02D0923C93B096EDDDDB811A9BF3
SHA-512:	56F8FEAB3F61F9608D2E9B4B2AF94A6E3608B77FFB33285832F60DAD5233953068DC41138FA816ABBC370C1C81CAE08B307BE7BC59F39980B0F1ECA53393E006
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF916884B4FACA16E7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF986860EB55264D84.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2105748413563577
Encrypted:	false
SSDEEP:	48:q9quIPveFXJjT58zucG1B0S50rlcG1B0SIRB:Oq47TkHY
MD5:	C6E7AEE9E064CB6C796EF2C250122335
SHA1:	FE86E682981F352EF4D9D90681C59BD5D8EF8F3A
SHA-256:	720E712E71074B22B407D1DA828EF1D7D49C02D0923C93B096EDDDDB811A9BF3
SHA-512:	56F8FEAB3F61F9608D2E9B4B2AF94A6E3608B77FFB33285832F60DAD5233953068DC41138FA816ABBC370C1C81CAE08B307BE7BC59F39980B0F1ECA53393E006
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB9075E916DCC9FC3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07102696039982931
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOgU1+gVky6lit/:2F0i8n0itFzDHFLAit/
MD5:	8A74DF7AAFCCA732BC21A49EAADF0E9E
SHA1:	983F716E1030A4AC17F4054D559F112AF626D41B
SHA-256:	20DC70296BE1AFD3A9673B5FB8562C01BCF96381E694CCDFF80C9EF76C89E5E4
SHA-512:	C119CC1C3813DC2AA16DF1157BDAA4166BE6C8C10FD1896256216951538A2F280463EEB7108B3CD6ECAB56EA841831644984ED304AE56B436ABFE0B3AFBBF580
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC0C8FB9A638FAC5B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5060591360020226
Encrypted:	false
SSDEEP:	48:48PhiuRc06WXJSFT5yzucG1B0S50rlcG1B0SIRB:Hhi1JFT+HY
MD5:	A9F64934AFBAFBE2500170B52541B6BD
SHA1:	EA71AC68A6D2C510B10890CBA84A21E8A89D9D74
SHA-256:	B831F939F66EF059C89546525AF41DDCFA017A790D3EB936AAD200567A9E71E8
SHA-512:	1BF8C7FB396C0F42F0130643A70E6D49E3D1B851937697BFD37D9B2F51B34A77BD531B80928DAAAD8DA9D345711E376E407531D344E97D6B589FA1C706AF4D72
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF55143F0CF381411.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF82D0BCE9FA84352.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2105748413563577
Encrypted:	false
SSDEEP:	48:q9quIPveFXJjT58zucG1B0S50rlcG1B0SIRB:Oq47TkHY
MD5:	C6E7AEE9E064CB6C796EF2C250122335
SHA1:	FE86E682981F352EF4D9D90681C59BD5D8EF8F3A
SHA-256:	720E712E71074B22B407D1DA828EF1D7D49C02D0923C93B096EDDDDB811A9BF3
SHA-512:	56F8FEAB3F61F9608D2E9B4B2AF94A6E3608B77FFB33285832F60DAD5233953068DC41138FA816ABBC370C1C81CAE08B307BE7BC59F39980B0F1ECA53393E006
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Audio Reader XL Premium, Author: IN MEDIAKG TI, Keywords: Installer, Comments: This installer database contains the logic and data required to install Audio Reader XL Premium., Template: Intel;1033, Revision Number: {F42B81C2-97E3-4FE6-BB7D-FDC864EFC273}, Create Time/Date: Wed Dec 4 21:17:08 2024, Last Saved Time/Date: Wed Dec 4 21:17:08 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Entropy (8bit):	7.995795486374199
TrID:	Microsoft Windows Installer (60509/1) 88.31% Generic OLE2 / Multistream Compound File (8008/1) 11.69%
File name:	cloudflare.msi
File size:	14'462'976 bytes
MD5:	5d2922491b47e1c355103194e069e5ac
SHA1:	eb918f926c9cc2f9239f1dfe0380727c8170982c
SHA256:	c348002e3d2cf40a2fc3c819a96b1735dc451bb3ec32ba9355feaccd3eee63c0
SHA512:	522be674a5fb20af9a4fa42315ae8e780df3310f5b0ea8feccca1cf788cd6af542226aed65e9c6f7353d2daf954522f4067880626a2ccf4b7793178b57eb0bd9
SSDEEP:	393216:GDFCbAjiImi73v4JPUQ6Rm1feeuQx1qbvto:GRCbAjCK6PEm12ZQx1qbFo
TLSH:	D3E63371B0D0003DE5C2AB72888252F72B298FA35EB87D1B99237C7478F72DA26574D1
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T16:19:20.342255+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.6	49985	193.188.22.40	443	TCP
2024-12-11T16:19:21.429638+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.6	49988	193.188.22.41	443	TCP
2024-12-11T16:19:22.638957+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.6	49992	89.116.191.177	443	TCP
2024-12-11T16:19:23.715965+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.6	49995	213.210.13.4	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:18:33.205986023 CET	49887	53	192.168.2.6	8.8.8.8
Dec 11, 2024 16:18:33.325331926 CET	53	49887	8.8.8.8	192.168.2.6
Dec 11, 2024 16:18:33.325525045 CET	49887	53	192.168.2.6	8.8.8.8
Dec 11, 2024 16:18:36.230657101 CET	53	49887	8.8.8.8	192.168.2.6
Dec 11, 2024 16:18:36.230772018 CET	49887	53	192.168.2.6	8.8.8.8
Dec 11, 2024 16:18:36.925396919 CET	49893	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:18:36.925448895 CET	443	49893	193.188.22.40	192.168.2.6
Dec 11, 2024 16:18:36.925528049 CET	49893	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:18:36.990717888 CET	49893	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:18:36.990761042 CET	443	49893	193.188.22.40	192.168.2.6
Dec 11, 2024 16:18:36.990777969 CET	49893	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:18:36.990787029 CET	443	49893	193.188.22.40	192.168.2.6
Dec 11, 2024 16:18:36.990844965 CET	443	49893	193.188.22.40	192.168.2.6
Dec 11, 2024 16:18:38.018603086 CET	49899	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:18:38.018661022 CET	443	49899	193.188.22.41	192.168.2.6
Dec 11, 2024 16:18:38.018728971 CET	49899	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:18:38.081234932 CET	49899	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:18:38.081254959 CET	443	49899	193.188.22.41	192.168.2.6
Dec 11, 2024 16:18:38.081289053 CET	49899	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:18:38.081296921 CET	443	49899	193.188.22.41	192.168.2.6
Dec 11, 2024 16:18:38.081342936 CET	443	49899	193.188.22.41	192.168.2.6
Dec 11, 2024 16:18:39.101597071 CET	49900	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:18:39.101706028 CET	443	49900	89.116.191.177	192.168.2.6
Dec 11, 2024 16:18:39.101780891 CET	49900	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:18:39.155961990 CET	49900	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:18:39.155961990 CET	49900	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:18:39.156003952 CET	443	49900	89.116.191.177	192.168.2.6
Dec 11, 2024 16:18:39.156018972 CET	443	49900	89.116.191.177	192.168.2.6
Dec 11, 2024 16:18:39.156055927 CET	443	49900	89.116.191.177	192.168.2.6
Dec 11, 2024 16:18:40.174428940 CET	49905	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:18:40.174501896 CET	443	49905	213.210.13.4	192.168.2.6
Dec 11, 2024 16:18:40.174832106 CET	49905	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:18:40.244729996 CET	49905	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:18:40.244774103 CET	443	49905	213.210.13.4	192.168.2.6
Dec 11, 2024 16:18:40.244796038 CET	49905	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:18:40.244806051 CET	443	49905	213.210.13.4	192.168.2.6
Dec 11, 2024 16:18:40.244827986 CET	443	49905	213.210.13.4	192.168.2.6
Dec 11, 2024 16:19:20.283485889 CET	49985	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:19:20.283548117 CET	443	49985	193.188.22.40	192.168.2.6
Dec 11, 2024 16:19:20.283643961 CET	49985	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:19:20.342255116 CET	49985	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:19:20.342283010 CET	443	49985	193.188.22.40	192.168.2.6
Dec 11, 2024 16:19:20.342331886 CET	49985	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:19:20.342336893 CET	443	49985	193.188.22.40	192.168.2.6
Dec 11, 2024 16:19:20.342359066 CET	443	49985	193.188.22.40	192.168.2.6
Dec 11, 2024 16:19:21.362127066 CET	49988	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:19:21.362175941 CET	443	49988	193.188.22.41	192.168.2.6
Dec 11, 2024 16:19:21.362236977 CET	49988	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:19:21.429637909 CET	49988	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:19:21.429662943 CET	443	49988	193.188.22.41	192.168.2.6
Dec 11, 2024 16:19:21.429722071 CET	443	49988	193.188.22.41	192.168.2.6
Dec 11, 2024 16:19:21.429769993 CET	49988	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:19:21.429784060 CET	443	49988	193.188.22.41	192.168.2.6
Dec 11, 2024 16:19:22.570497990 CET	49992	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:19:22.570574045 CET	443	49992	89.116.191.177	192.168.2.6
Dec 11, 2024 16:19:22.570628881 CET	49992	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:19:22.638957024 CET	49992	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:19:22.639015913 CET	443	49992	89.116.191.177	192.168.2.6
Dec 11, 2024 16:19:22.639062881 CET	49992	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:19:22.639070988 CET	443	49992	89.116.191.177	192.168.2.6
Dec 11, 2024 16:19:22.639094114 CET	443	49992	89.116.191.177	192.168.2.6
Dec 11, 2024 16:19:23.658066034 CET	49995	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:19:23.658107042 CET	443	49995	213.210.13.4	192.168.2.6
Dec 11, 2024 16:19:23.658157110 CET	49995	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:19:23.715965033 CET	49995	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:19:23.715987921 CET	443	49995	213.210.13.4	192.168.2.6
Dec 11, 2024 16:19:23.716058016 CET	443	49995	213.210.13.4	192.168.2.6
Dec 11, 2024 16:19:23.716099977 CET	49995	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:19:23.716114998 CET	443	49995	213.210.13.4	192.168.2.6
Dec 11, 2024 16:19:23.728243113 CET	49996	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:19:23.728303909 CET	443	49996	193.188.22.40	192.168.2.6
Dec 11, 2024 16:19:23.728358030 CET	49996	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:19:23.797766924 CET	49996	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:19:23.797791004 CET	443	49996	193.188.22.40	192.168.2.6
Dec 11, 2024 16:19:23.797826052 CET	49996	443	192.168.2.6	193.188.22.40
Dec 11, 2024 16:19:23.797833920 CET	443	49996	193.188.22.40	192.168.2.6
Dec 11, 2024 16:19:23.798178911 CET	443	49996	193.188.22.40	192.168.2.6
Dec 11, 2024 16:19:23.808804989 CET	49997	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:19:23.808861017 CET	443	49997	193.188.22.41	192.168.2.6
Dec 11, 2024 16:19:23.808938980 CET	49997	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:19:23.873961926 CET	49997	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:19:23.873980045 CET	443	49997	193.188.22.41	192.168.2.6
Dec 11, 2024 16:19:23.874041080 CET	49997	443	192.168.2.6	193.188.22.41
Dec 11, 2024 16:19:23.874047995 CET	443	49997	193.188.22.41	192.168.2.6
Dec 11, 2024 16:19:23.874053955 CET	443	49997	193.188.22.41	192.168.2.6
Dec 11, 2024 16:19:23.884790897 CET	49998	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:19:23.884841919 CET	443	49998	89.116.191.177	192.168.2.6
Dec 11, 2024 16:19:23.884912968 CET	49998	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:19:23.942169905 CET	49998	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:19:23.942199945 CET	443	49998	89.116.191.177	192.168.2.6
Dec 11, 2024 16:19:23.942248106 CET	49998	443	192.168.2.6	89.116.191.177
Dec 11, 2024 16:19:23.942249060 CET	443	49998	89.116.191.177	192.168.2.6
Dec 11, 2024 16:19:23.942265034 CET	443	49998	89.116.191.177	192.168.2.6
Dec 11, 2024 16:19:23.950886965 CET	49999	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:19:23.950930119 CET	443	49999	213.210.13.4	192.168.2.6
Dec 11, 2024 16:19:23.950997114 CET	49999	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:19:24.006602049 CET	49999	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:19:24.006622076 CET	443	49999	213.210.13.4	192.168.2.6
Dec 11, 2024 16:19:24.006663084 CET	443	49999	213.210.13.4	192.168.2.6
Dec 11, 2024 16:19:24.006675959 CET	49999	443	192.168.2.6	213.210.13.4
Dec 11, 2024 16:19:24.006689072 CET	443	49999	213.210.13.4	192.168.2.6

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 16:17:17.792079926 CET	1.1.1.1	192.168.2.6	0x6423	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:17:17.792079926 CET	1.1.1.1	192.168.2.6	0x6423	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	10:17:20
Start date:	11/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cloudflare.msi"
Imagebase:	0x7ff6d6b50000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:17:20
Start date:	11/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6d6b50000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:17:23
Start date:	11/12/2024
Path:	C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe"
Imagebase:	0x400000
File size:	2'364'872 bytes
MD5 hash:	5D8A546C266CC1D2F14B3BE5C662C67A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000003.00000003.2319331288.0000000006688000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000003.00000002.3517175546.0000000008909000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000003.00000002.3510975434.0000000008350000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000003.00000003.2323823864.00000000060FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000003.00000003.2331632512.00000000071A9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	38.2%
Signature Coverage:	6.7%
Total number of Nodes:	492
Total number of Limit Nodes:	31

Executed Functions

Function 00AF5858 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,00B470A4), ref: 00AF5873
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00B470A4), ref: 00AF5891
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00B470A4), ref: 00AF58AF
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00AF58CD
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00AF595C,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00AF5916
RegQueryValueExA.ADVAPI32(?,00AF5AD8,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00AF595C,?,80000001), ref: 00AF5934
RegCloseKey.ADVAPI32(?,00AF5963,00000000,?,?,00000000,00AF595C,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00AF5956
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00AF5973
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00AF5980
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00AF5986
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00AF59B1
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00AF5A06
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00AF5A16
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00AF5A42
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00AF5A52
lstrcpyn.KERNEL32(?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00AF5A7C
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,00000105,?,00000000,00000002,?,?,00000105,?,00000000,00000003,?), ref: 00AF5A8C

Strings

Software\Borland\Delphi\Locales, xrefs: 00AF58C3
Software\Borland\Locales, xrefs: 00AF5887, 00AF58A5

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 0a3174fa63416b5b3f56987f22cbcdc8a52c4f801e9ec57344ca1ee7c2873743
Instruction ID: a3fcb3c19e0199123796a099a3514667c0b6199a617e1e04293df385ca3e16fa
Opcode Fuzzy Hash: 0a3174fa63416b5b3f56987f22cbcdc8a52c4f801e9ec57344ca1ee7c2873743
Instruction Fuzzy Hash: E4612271E4460EBEEB15EBE8CD86FFFB7BC9B08700F5041A1B744E6181D6B49A548B50

Function 00B41954 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00B419DA), ref: 00B4196E

Part of subcall function 00B41720: GetCurrentProcessId.KERNEL32(?,00000000,00B41898), ref: 00B41741
Part of subcall function 00B41720: GlobalAddAtomA.KERNEL32(00000000), ref: 00B41774
Part of subcall function 00B41720: GetCurrentThreadId.KERNEL32 ref: 00B4178F
Part of subcall function 00B41720: GlobalAddAtomA.KERNEL32(00000000), ref: 00B417C5
Part of subcall function 00B41720: RegisterClipboardFormatA.USER32(00000000), ref: 00B417DB
Part of subcall function 00B41720: GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,?,00000000,00B41898), ref: 00B4185F
Part of subcall function 00B41720: GetProcAddress.KERNEL32(00000000,AnimateWindow), ref: 00B41870

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: AtomCurrentGlobal$AddressClipboardFormatHandleModuleProcProcessRegisterThreadVersion
String ID:
API String ID: 3775504709-0
Opcode ID: 49f02484947a4e08271048ab03f7623cfe6c8f340ed31bcbb3d87d58cc00115a
Instruction ID: ac8479eb59de81f5b1429b0ada5ade8d7962e4dc96ad6c6efcbcf6f41f61d4e7
Opcode Fuzzy Hash: 49f02484947a4e08271048ab03f7623cfe6c8f340ed31bcbb3d87d58cc00115a
Instruction Fuzzy Hash: 07F090782842018FD704FB28FD639197FE5F7553013A188B1F804836B2CE30AE22DB44

Function 00B41720 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 103
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00B41898), ref: 00B41741
GlobalAddAtomA.KERNEL32(00000000), ref: 00B41774
GetCurrentThreadId.KERNEL32 ref: 00B4178F
GlobalAddAtomA.KERNEL32(00000000), ref: 00B417C5
RegisterClipboardFormatA.USER32(00000000), ref: 00B417DB

Part of subcall function 00B074B4: RtlInitializeCriticalSection.KERNEL32(00B04FF0,?,?,00B0DF7D,00000000,00B0DFA1), ref: 00B074D3

Part of subcall function 00B41324: SetErrorMode.KERNEL32(00008000), ref: 00B4133D
Part of subcall function 00B41324: GetModuleHandleA.KERNEL32(USER32,00000000,00B4148A,?,00008000), ref: 00B41361
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,WINNLSEnableIME), ref: 00B4136E
Part of subcall function 00B41324: LoadLibraryA.KERNEL32(imm32.dll,00000000,00B4148A,?,00008000), ref: 00B4138A
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmGetContext), ref: 00B413AC
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmReleaseContext), ref: 00B413C1
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmGetConversionStatus), ref: 00B413D6
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmSetConversionStatus), ref: 00B413EB
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmSetOpenStatus), ref: 00B41400
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmSetCompositionWindow), ref: 00B41415
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmSetCompositionFontA), ref: 00B4142A
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmGetCompositionStringA), ref: 00B4143F
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmIsIME), ref: 00B41454
Part of subcall function 00B41324: GetProcAddress.KERNEL32(00000000,ImmNotifyIME), ref: 00B41469
Part of subcall function 00B41324: SetErrorMode.KERNEL32(?,00B41491,00008000), ref: 00B41484

Part of subcall function 00B25C84: GetKeyboardLayout.USER32(00000000), ref: 00B25CC9
Part of subcall function 00B25C84: 73E9A570.USER32(00000000), ref: 00B25D1E
Part of subcall function 00B25C84: 73EA4620.GDI32(00000000,0000005A,00000000), ref: 00B25D28
Part of subcall function 00B25C84: 73E9A480.USER32(00000000,00000000,00000000,0000005A,00000000), ref: 00B25D33

Part of subcall function 00B26D98: LoadIconA.USER32(00000000,MAINICON), ref: 00B26E7D
Part of subcall function 00B26D98: GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 00B26EAF
Part of subcall function 00B26D98: OemToCharA.USER32(?,?), ref: 00B26EC2
Part of subcall function 00B26D98: CharNextA.USER32(?,00000000,?,00000100), ref: 00B26F0F
Part of subcall function 00B26D98: CharLowerA.USER32(00000000,?,00000000,?,00000100), ref: 00B26F15

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,?,00000000,00B41898), ref: 00B4185F
GetProcAddress.KERNEL32(00000000,AnimateWindow), ref: 00B41870

Strings

USER32, xrefs: 00B4185A
Delphi%.8X, xrefs: 00B41752
ControlOfs%.8X%.8X, xrefs: 00B417A3
AnimateWindow, xrefs: 00B4186A

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: AddressProc$CharModule$AtomCurrentErrorGlobalHandleLoadMode$A4620A480A570ClipboardCriticalFileFormatIconInitializeKeyboardLayoutLibraryLowerNameNextProcessRegisterSectionThread
String ID: AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$USER32
API String ID: 814285418-1126952177
Opcode ID: 769e1502aaebb5b0b2e589d914d3656d7414f360618e5509cb9d5ebfc2dec1d2
Instruction ID: ed210437b73f9ee3406d2382dc49ddaa48ad7782c2c2c4c55054e503a29f0efb
Opcode Fuzzy Hash: 769e1502aaebb5b0b2e589d914d3656d7414f360618e5509cb9d5ebfc2dec1d2
Instruction Fuzzy Hash: 51413D78A142499FCB00FFB8ED829AE77F5FB1A304B5045A5F504EB362DF34AA409B54

Function 6C8BB507 Relevance: 10.6, APIs: 7, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C8BB54E
___scrt_uninitialize_crt.LIBCMT ref: 6C8BB568

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 6bd9675e2947852fd2d9e23a46a019c8fc181c7c03f86469d3c9ada31349d9fb
Instruction ID: e34fe15a7a7542d6765374c4d1a467b567475a0fa2200e901665b705e183ecf3
Opcode Fuzzy Hash: 6bd9675e2947852fd2d9e23a46a019c8fc181c7c03f86469d3c9ada31349d9fb
Instruction Fuzzy Hash: 23419272E15619AEDB308F58CF80ABE3AB5EF46768F104929E81477B50D7318D058BA0

Function 00B26D98 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00000000,MAINICON), ref: 00B26E7D
GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 00B26EAF
OemToCharA.USER32(?,?), ref: 00B26EC2
CharNextA.USER32(?,00000000,?,00000100), ref: 00B26F0F
CharLowerA.USER32(00000000,?,00000000,?,00000100), ref: 00B26F15

Strings

MAINICON, xrefs: 00B26E70

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleNameNext
String ID: MAINICON
API String ID: 3256280155-2283262055
Opcode ID: cef04b68f650bc1e975d77497eee5e3f4066bbc9b6d6f864ec1bd627ceeeb6f0
Instruction ID: 657d50fd335135ac0ffec9e95446f2ab5edf7634ae01bdbf448f1f555de08236
Opcode Fuzzy Hash: cef04b68f650bc1e975d77497eee5e3f4066bbc9b6d6f864ec1bd627ceeeb6f0
Instruction Fuzzy Hash: 32516971A042988FDB40EF78D885BC97BE4AB15304F0480F5E988DF357DBB59A88CB61

Function 00B26490 Relevance: 10.6, APIs: 7, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoA.USER32(0000001F,0000003C,?,00000000), ref: 00B264E4
CreateFontIndirectA.GDI32(?), ref: 00B264F1
GetStockObject.GDI32(0000000D), ref: 00B26507

Part of subcall function 00B11B9C: MulDiv.KERNEL32(00000000,?,00000048), ref: 00B11BA9

SystemParametersInfoA.USER32(00000029,00000000,00000154,00000000), ref: 00B26530
CreateFontIndirectA.GDI32(?), ref: 00B26540
CreateFontIndirectA.GDI32(?), ref: 00B26559
GetStockObject.GDI32(0000000D), ref: 00B2657F

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: CreateFontIndirect$InfoObjectParametersStockSystem
String ID:
API String ID: 2891467149-0
Opcode ID: b9fa66500c46e1d0ef1197dca7e95ae0a9d6c69b24a7f89a41217ebd9b850929
Instruction ID: 2df5c8b27fe409d645d5ac6d0334e419a60fa90f5391eef45dc1ebdd6fa95822
Opcode Fuzzy Hash: b9fa66500c46e1d0ef1197dca7e95ae0a9d6c69b24a7f89a41217ebd9b850929
Instruction Fuzzy Hash: 0D3150346042589BE750EFA8EC82B9A37E4FB44304F8484F0BA4CDB29ADF709944C721

Function 00AF1BE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(00B495CC,00000000,00AF1CA8,?,?,?,00AF2606), ref: 00AF1BF7
RtlEnterCriticalSection.KERNEL32(00B495CC,00B495CC,00000000,00AF1CA8,?,?,?,00AF2606), ref: 00AF1C0A
LocalAlloc.KERNEL32(00000000,00000FF8,00B495CC,00000000,00AF1CA8,?,?,?,00AF2606), ref: 00AF1C34
RtlLeaveCriticalSection.KERNEL32(00B495CC,00AF1CAF,00000000,00AF1CA8,?,?,?,00AF2606), ref: 00AF1CA2

Strings

,Xn, xrefs: 00AF1C19
<Xn, xrefs: 00AF1C0F

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: ,Xn$<Xn
API String ID: 730355536-2313646270
Opcode ID: 3390cdfa16c784578699327a7c79a9191747da1c570ee7d1d7d0bf23ae8d0d41
Instruction ID: 487f7142314f069cb4e2cb0d74edb04eff85f66c1b65f8df5cfcb80b990f789e
Opcode Fuzzy Hash: 3390cdfa16c784578699327a7c79a9191747da1c570ee7d1d7d0bf23ae8d0d41
Instruction Fuzzy Hash: CA11C4B4644308EFD716EFD5CA01B3A77E4FB5A300F1044A4F200873A1CA744E41DB55

Function 6C882EE2 Relevance: 9.4, APIs: 6, Instructions: 402
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,00000023,00000000,00002000), ref: 6C883233
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000023,00000000,00002000), ref: 6C883250
Sleep.KERNEL32(0000001E,?,?,?,?,?,?,?,?,?,?,?,00000023,00000000,00002000), ref: 6C88325F
Sleep.KERNEL32(00000032,?,?,?,?,?,?,00000023,00000000,00002000), ref: 6C88326C
Concurrency::cancel_current_task.LIBCPMT ref: 6C88353F
In_Interface_Web.ABCPDF ref: 6C883550

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: CurrentProcessSleep$Concurrency::cancel_current_taskInterface_
String ID:
API String ID: 3554754347-0
Opcode ID: 39ca4c6e05aa34fb8083217722a0b9bc376bd59ed748ba073fe430640c34428e
Instruction ID: 5278a231b04af9786d5e7f5055c872902251523b08e9ad7a530508ae44ba6a41
Opcode Fuzzy Hash: 39ca4c6e05aa34fb8083217722a0b9bc376bd59ed748ba073fe430640c34428e
Instruction Fuzzy Hash: DDF1C5B19157419BD731CB34C944BDFB3E8AF85308F108F3EE559A7A80EB34A6488B52

Function 6C882DE0 Relevance: 7.7, APIs: 5, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 6C882E04
GetCurrentDirectoryW.KERNEL32(00000104,?,00001000), ref: 6C882E70

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: CurrentDirectoryInitialize
String ID:
API String ID: 3250367583-0
Opcode ID: 99b04af65d6f4c7a792a93305054707430949b7c11374ec342b5bdb943fa1482
Instruction ID: b8ed324f252bcf2ab3bd648aeda84985980a02d97d888e399cec8345e4333175
Opcode Fuzzy Hash: 99b04af65d6f4c7a792a93305054707430949b7c11374ec342b5bdb943fa1482
Instruction Fuzzy Hash: 9A814E715493809AE730CF24C945FDBB7E8BF84704F104E2EF689A6680EBB1A548CB56

Function 00B25C84 Relevance: 6.1, APIs: 4, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetKeyboardLayout.USER32(00000000), ref: 00B25CC9
73E9A570.USER32(00000000), ref: 00B25D1E
73EA4620.GDI32(00000000,0000005A,00000000), ref: 00B25D28
73E9A480.USER32(00000000,00000000,00000000,0000005A,00000000), ref: 00B25D33

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: A4620A480A570KeyboardLayout
String ID:
API String ID: 3268288004-0
Opcode ID: 2ab0fdcb329557e0bc2c4def36339ece32857a4ae19c86bfd328956b0e2bdba5
Instruction ID: 3e1f40169c8d7efcde9f054e40b8276f0feb8fc697ae9eed94642d483a64bb46
Opcode Fuzzy Hash: 2ab0fdcb329557e0bc2c4def36339ece32857a4ae19c86bfd328956b0e2bdba5
Instruction Fuzzy Hash: CA3106B16102449FD740EF6CE9C5B997BE0BB16315F8480A9FA0CDF362DB7698488B60

Function 6C882AE0 Relevance: 4.8, APIs: 3, Instructions: 270
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C882A20: GetDesktopWindow.USER32 ref: 6C882A84
Part of subcall function 6C882A20: GetTopWindow.USER32(00000000), ref: 6C882A8B
Part of subcall function 6C882A20: GetWindow.USER32(00000000,00000002), ref: 6C882ABF

GetWindowThreadProcessId.USER32(6C8ED4B6,6C882C8E), ref: 6C882B7F
IsWindowVisible.USER32(?), ref: 6C882CAA
ShowWindow.USER32(?,00000000,?,00000000,000000FF), ref: 6C882D75

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Window$DesktopProcessShowThreadVisible
String ID:
API String ID: 2112749491-0
Opcode ID: 2d36cf237188ba7dcb1acf29a07fff5ad8d99672bad9c00c67d00f3cdb53c5c4
Instruction ID: 1fbed7bf2b87ae335f0aa877a7bc94770a2253ee8f155d7eb7481bcaea225733
Opcode Fuzzy Hash: 2d36cf237188ba7dcb1acf29a07fff5ad8d99672bad9c00c67d00f3cdb53c5c4
Instruction Fuzzy Hash: 8B91A271D025199BDB20CFA8CA847EEF7B4FF49328F200619E815B7B80D7796944CB94

Function 6C882A20 Relevance: 4.6, APIs: 3, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 6C882A84
GetTopWindow.USER32(00000000), ref: 6C882A8B
GetWindow.USER32(00000000,00000002), ref: 6C882ABF

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Window$Desktop
String ID:
API String ID: 2849500299-0
Opcode ID: c67a007ed031bf3d353e4e08318a29928c5e78c1aeb4988f5277d997dd5db294
Instruction ID: dfb77cafb331c5557740033371d5d074df556ec878b239279138c5d44c355a27
Opcode Fuzzy Hash: c67a007ed031bf3d353e4e08318a29928c5e78c1aeb4988f5277d997dd5db294
Instruction Fuzzy Hash: 37216D719017099FC721CF59D988B6BBBF8FF89714F108A2EE45593B40D779A904CB90

Function 00AF1640 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00AF19D3), ref: 00AF166F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00AF19D3), ref: 00AF1696

Strings

<Xn, xrefs: 00AF167E

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: <Xn
API String ID: 2087232378-173563621
Opcode ID: 65b766c2cc0406b7c42621392eea1afd01b4b80923b8c3c9759b1fa891415073
Instruction ID: 74c2809d4fd562948447777dd8538baec31be0e5024349e239c9eddd92a5aa96
Opcode Fuzzy Hash: 65b766c2cc0406b7c42621392eea1afd01b4b80923b8c3c9759b1fa891415073
Instruction Fuzzy Hash: 7FF027B2B0032497DBA05AE94D81B726AD59F95790F1901B1FB0CEF3C9E2618C0043A0

Function 00AF3F9C Relevance: 3.1, APIs: 2, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de881168ddca122460e143f6ef9e56d290b8e0f75516314c2965ad7cc6a9f4ac
Instruction ID: 539a4b417454b66b3cc8852c2bab682d3582d266ffddf468329e020675b40804
Opcode Fuzzy Hash: de881168ddca122460e143f6ef9e56d290b8e0f75516314c2965ad7cc6a9f4ac
Instruction Fuzzy Hash: BD416D798052488FDB25DFE8D8847BB7BE0BB4A320F154569FA4887262CB348E84CB55

Function 00AF243C Relevance: 3.1, APIs: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AF1BE0: RtlInitializeCriticalSection.KERNEL32(00B495CC,00000000,00AF1CA8,?,?,?,00AF2606), ref: 00AF1BF7
Part of subcall function 00AF1BE0: RtlEnterCriticalSection.KERNEL32(00B495CC,00B495CC,00000000,00AF1CA8,?,?,?,00AF2606), ref: 00AF1C0A
Part of subcall function 00AF1BE0: LocalAlloc.KERNEL32(00000000,00000FF8,00B495CC,00000000,00AF1CA8,?,?,?,00AF2606), ref: 00AF1C34
Part of subcall function 00AF1BE0: RtlLeaveCriticalSection.KERNEL32(00B495CC,00AF1CAF,00000000,00AF1CA8,?,?,?,00AF2606), ref: 00AF1CA2

RtlEnterCriticalSection.KERNEL32(00B495CC,00000000,00AF25D8), ref: 00AF2485
RtlLeaveCriticalSection.KERNEL32(00B495CC,00AF25DF), ref: 00AF25D2

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID:
API String ID: 2227675388-0
Opcode ID: c6307b6399c0245afa7181fb0cef072f72882667d2ff7f72a3564ac802ec4a81
Instruction ID: 0d501239271e414c4cfa14ea055515be1b7ec947f3688596aa29b3af38dd2343
Opcode Fuzzy Hash: c6307b6399c0245afa7181fb0cef072f72882667d2ff7f72a3564ac802ec4a81
Instruction Fuzzy Hash: F8516CB4A00309DFDB10DFA8D98167EB7F0FB49310F218269E914A7351DB349A81CF51

Function 00B26040 Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00B2604D
LoadCursorA.USER32(00000000,00000000), ref: 00B2607C

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: ac37e523e20486d800f19c13fedce4cf7b25036b00bdc230b3ac6a6e489a1768
Instruction ID: f619c06b772c2fea47654a3302708544ce0ff4488118e941ee7b0aa892421718
Opcode Fuzzy Hash: ac37e523e20486d800f19c13fedce4cf7b25036b00bdc230b3ac6a6e489a1768
Instruction Fuzzy Hash: 84F08C31B046681B9620167D6CD1A7B73D8DB96330B2003B6FA3ED76E2CA666C41A661

Function 6C8C3A7D Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,6C8C8B07,?,00000000,?,?,6C8C8B2C,?,00000007,?,?,6C8C87F4,?,?), ref: 6C8C3A93
GetLastError.KERNEL32(?,?,6C8C8B07,?,00000000,?,?,6C8C8B2C,?,00000007,?,?,6C8C87F4,?,?), ref: 6C8C3A9E

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f9e1eb02638373ba87e6d26e17c418a7ba7a3a838ada95ef8a8aa5fc27160b94
Instruction ID: 3431fbb042600f7f5a07a126a71911d72f3e4ef153a417b22f2c11e54514d9a7
Opcode Fuzzy Hash: f9e1eb02638373ba87e6d26e17c418a7ba7a3a838ada95ef8a8aa5fc27160b94
Instruction Fuzzy Hash: 32E08631304A04BBCB311FB5AA0CBC53B78EB4535DF104430FA089B550D734C855C791

Function 6C8835F0 Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6C88376C

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bc9abbc6abc06696e52df63a07e38c6e47e031144c7c0eb451611edfdd8975ad
Instruction ID: bb494fbe3a6a9b0e411ee4725ed1f2c4ad40a4335ed01e198ec3c10ef665ea9b
Opcode Fuzzy Hash: bc9abbc6abc06696e52df63a07e38c6e47e031144c7c0eb451611edfdd8975ad
Instruction Fuzzy Hash: 3C41E471B0121A9BCB24DFBCCAD099EB3E5BF483147144A79E811D7B45E730EE148B90

Function 6C883780 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6C8838C7

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bf60bb9bf7282af117b2ead31447b96ec6995998c8252a99398ec738d6955be7
Instruction ID: 1547613c467d649db6019a7182f2ef042a9f77f3d8d36f12f115edab90b9808c
Opcode Fuzzy Hash: bf60bb9bf7282af117b2ead31447b96ec6995998c8252a99398ec738d6955be7
Instruction Fuzzy Hash: 924124B1A015159FD728CF6CCA809AEB7A4EF883147548B39E815D3F80E730EE45C790

Function 6C882C10 Relevance: 1.6, APIs: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6C882AE0: GetWindowThreadProcessId.USER32(6C8ED4B6,6C882C8E), ref: 6C882B7F

IsWindowVisible.USER32(?), ref: 6C882CAA
ShowWindow.USER32(?,00000000,?,00000000,000000FF), ref: 6C882D75

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Window$ProcessShowThreadVisible
String ID:
API String ID: 2688220658-0
Opcode ID: 4ad71182a021d033c36a6ec6e16c35567af734422e5c95295c39c3035837b0e4
Instruction ID: c0b15d0efbae019eafe3ed1292ef226e0b24d50805a6c65a2f477c4bb3fd6c23
Opcode Fuzzy Hash: 4ad71182a021d033c36a6ec6e16c35567af734422e5c95295c39c3035837b0e4
Instruction Fuzzy Hash: AD3181B1D016199BDB10CF98CA847AEFBB0FF49324F104619D811A7B80D7796944CBA4

Function 6C882D30 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C882C10: IsWindowVisible.USER32(?), ref: 6C882CAA

ShowWindow.USER32(?,00000000,?,00000000,000000FF), ref: 6C882D75

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Window$ShowVisible
String ID:
API String ID: 4185057100-0
Opcode ID: d5998373b8b36516933dc66193e17a4a7cab60de38c68ff55d0fc61b63e6dd55
Instruction ID: 2db8e5cd95404029f43f2d4451ce7474215a0da6f5643aa9d6b1b6412a8527cf
Opcode Fuzzy Hash: d5998373b8b36516933dc66193e17a4a7cab60de38c68ff55d0fc61b63e6dd55
Instruction Fuzzy Hash: D711C432E021289BCB10DE78DD947FEB7B4AF09325F150769E851B7B80D739AD448694

Function 6C8BB033 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6C88289E

Part of subcall function 6C8BCBDA: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,6C8BB024,?,6C91F7EC,?), ref: 6C8BCC3B

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID:
API String ID: 3109751735-0
Opcode ID: 429c88a20440c29e73ee487ac082b6cdd2e97704be4dc56bfac8d25158ad83eb
Instruction ID: 90a3ac6160daedaf6d30c2c1e2295417dd6d605dcb1dcfe2127d4f0e8dd5a664
Opcode Fuzzy Hash: 429c88a20440c29e73ee487ac082b6cdd2e97704be4dc56bfac8d25158ad83eb
Instruction Fuzzy Hash: B101043680030C77CB34AEECDD858DA77AC9B01628B504D31AA24B6F50EB30E54C82D5

Function 6C8C3AB7 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,6C8BB016,?,?,6C8BC2F0,?,?,?,?,?,6C8BAF7A,6C8BB016,?,?,?,?), ref: 6C8C3AE9

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 87a66c5beea5f111bdeeadfe91f65362dd973969cf58b30b05920208fee075b9
Instruction ID: e1f7b766066891d8ae630dd76003081ba207dbb6faed7637dc6b023e8c728dbf
Opcode Fuzzy Hash: 87a66c5beea5f111bdeeadfe91f65362dd973969cf58b30b05920208fee075b9
Instruction Fuzzy Hash: 10E0E531351E256BE7309B6B9E04BCB365C9F462B8F114930EC1097980DB60CC2282E3

Function 00AF55C4 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00AF0000,?,00000105), ref: 00AF55E2

Part of subcall function 00AF5858: GetModuleFileNameA.KERNEL32(00000000,?,00000105,00B470A4), ref: 00AF5873
Part of subcall function 00AF5858: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00B470A4), ref: 00AF5891
Part of subcall function 00AF5858: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00B470A4), ref: 00AF58AF
Part of subcall function 00AF5858: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00AF58CD
Part of subcall function 00AF5858: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00AF595C,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00AF5916
Part of subcall function 00AF5858: RegQueryValueExA.ADVAPI32(?,00AF5AD8,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00AF595C,?,80000001), ref: 00AF5934
Part of subcall function 00AF5858: RegCloseKey.ADVAPI32(?,00AF5963,00000000,?,?,00000000,00AF595C,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00AF5956

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 2b51127376f963e1f92ddf71d9fdd713ecbcb36da634af5b8f0ca24f7d2badbb
Instruction ID: c279ae3fc45b20c056fbc03ef7067e9d12c59df8b5712ee4b5e3dc089c012c71
Opcode Fuzzy Hash: 2b51127376f963e1f92ddf71d9fdd713ecbcb36da634af5b8f0ca24f7d2badbb
Instruction Fuzzy Hash: 5CE06D71A006188BCB10DFEC89C1A9633D8AF08764F000961BE68CF24AD370DD108BD0

Function 6C883560 Relevance: 1.5, APIs: 1, Instructions: 14threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,6C883550,00000000,00000000,00000000), ref: 6C883578

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a227800c27246216d9249d2b791d67dc13bc460ea4b0be8c58f94763d918c752
Instruction ID: d91da2938cf04532db09422ba618426a246c5af0c02d9ea80b4aa20eb66de3bd
Opcode Fuzzy Hash: a227800c27246216d9249d2b791d67dc13bc460ea4b0be8c58f94763d918c752
Instruction Fuzzy Hash: 18D08C343C4308B3F2300AA65E0BF1433684B11F24F208810F7043FEC041E1BE408A5D

Function 00B0DCD0 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 00B0DCEE

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ef21373a2c931d1885005fc48c5aee924c8a5424a2c91551018fd20b450fb3a3
Instruction ID: 950aa100d99dbcc83d01d0abf8c9d75d534d5b9c78d6678f5f2f1d91433ba861
Opcode Fuzzy Hash: ef21373a2c931d1885005fc48c5aee924c8a5424a2c91551018fd20b450fb3a3
Instruction Fuzzy Hash: 9D115A752403099BD720DF58C880B96FBE4EF89390F10C57AEA588B385D770E905CBA0

Non-executed Functions

Function 6C8A8CB0 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 832COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8A8F43

Strings

SvTq, xrefs: 6C8A91CF
SvTq, xrefs: 6C8A96D3

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: SvTq$SvTq
API String ID: 885266447-2489124442
Opcode ID: 1936118aae131bd6d8a854a5561597b5f895e5642b113f0a4fd53aa4f0a3daaa
Instruction ID: b1b308445ee1a2b1fe698b5bb7243bca181cde83e4c95e8b3420b9582128e980
Opcode Fuzzy Hash: 1936118aae131bd6d8a854a5561597b5f895e5642b113f0a4fd53aa4f0a3daaa
Instruction Fuzzy Hash: 6D724371A083528FC324CF69C58064AF7E1BFD9344F054E2EE9A59B790D771E94ACB82

Function 6C8BBC68 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 6C8BBC74
IsDebuggerPresent.KERNEL32 ref: 6C8BBD40
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C8BBD59
UnhandledExceptionFilter.KERNEL32(?), ref: 6C8BBD63

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d237fd32da80431c3bccde7ecce9a4018e511cb3efcb95230f626fa9e24a3e54
Instruction ID: bc72c6cbae60692c36ede16e8197a31c4b3e6a6caa61e770b3873b31fa7c2076
Opcode Fuzzy Hash: d237fd32da80431c3bccde7ecce9a4018e511cb3efcb95230f626fa9e24a3e54
Instruction Fuzzy Hash: 1D31E9B5D05218DBDF21DF65D9897CDBBB8AF08304F1041EAE40DAB250E7749A84CF85

Function 6C8BBDE3 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 6C8BBDF5
GetCurrentThreadId.KERNEL32 ref: 6C8BBE04
GetCurrentProcessId.KERNEL32 ref: 6C8BBE0D
QueryPerformanceCounter.KERNEL32(?), ref: 6C8BBE1A

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 954b3faf7ef37d779319c83564f2e40dbc88f00d6c26b6b6c539c7b9ba6c7732
Instruction ID: f39b144e15607d23b22543abad0dae11ab80f4e73c5525a38308fe34b5f74d56
Opcode Fuzzy Hash: 954b3faf7ef37d779319c83564f2e40dbc88f00d6c26b6b6c539c7b9ba6c7732
Instruction Fuzzy Hash: 41F05F74D1020DEBCF50DBB4D64999EBBF4EF2D204B9189A5A412E6100E734AB44DB90

Function 6C8B9DA0 Relevance: 4.0, Strings: 2, Instructions: 1501COMMON

Download Yara Rule

Strings

@, xrefs: 6C8BAD6A
, xrefs: 6C8BA1AA

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: d095a087586ed19df8e0063e34350f63c656d0ac901a3947138acc530e898ffb
Instruction ID: 7c0980d4d387a53506123ecd63cbcc53b291543150d3a4e193722d3594f7a47d
Opcode Fuzzy Hash: d095a087586ed19df8e0063e34350f63c656d0ac901a3947138acc530e898ffb
Instruction Fuzzy Hash: B8C23F72B083108BD75CCE19D86156BF7E3ABC8314F09892EF89AD3345DA74DC568B86

Function 00B440E8 Relevance: 3.3, APIs: 2, Instructions: 251comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00B47434,00000000,00000007,00B47454,00000000,00000000,00B44430), ref: 00B44354
CoCreateInstance.OLE32(00B47444,00000000,00000007,00B47474,00000000,00B47434,00000000,00000007,00B47454,00000000,00000000,00B44430), ref: 00B443A4

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: d2c9e89d64e471c577c95b0bf93f3b6ca6d43f27005f81dfda161864fc3c93bd
Instruction ID: 9d71d7a0685d77b6140fe12ff950cca9b9f249c2c2100e6bd2b8712d46e39ecc
Opcode Fuzzy Hash: d2c9e89d64e471c577c95b0bf93f3b6ca6d43f27005f81dfda161864fc3c93bd
Instruction Fuzzy Hash: 67B1F375A00608AFDB50DFA8C985BAAB7F9FF09305F5441E5E508EB262DB30AE44DF11

Function 6C8D1C20 Relevance: 2.7, Strings: 2, Instructions: 244COMMON

Download Yara Rule

Strings

.././../src/v6.3.0-036e54f1a3.clean/mpz/pprime_p.c, xrefs: 6C8D1EB8
__gmpn_mod_1 (((n)->_mp_d), (mp_size_t) ((n)->_mp_size), (mp_limb_t) primes[nprimes]) == 0, xrefs: 6C8D1EAE

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID: .././../src/v6.3.0-036e54f1a3.clean/mpz/pprime_p.c$__gmpn_mod_1 (((n)->_mp_d), (mp_size_t) ((n)->_mp_size), (mp_limb_t) primes[nprimes]) == 0
API String ID: 0-2966990738
Opcode ID: cfd17f8d7d327fec0cede7d5c44eb17ea3d259caf6fa81550ffc8853d67fbf7a
Instruction ID: 9241332d3cf1508d4389293e7c821affa9103d7dd263e6d980d4c60df7fdb461
Opcode Fuzzy Hash: cfd17f8d7d327fec0cede7d5c44eb17ea3d259caf6fa81550ffc8853d67fbf7a
Instruction Fuzzy Hash: C76146717001065BDB289F7C9F4257E76DA9FC4758F424D39E84ACAB80EB20F91887D2

Function 6C89EDE0 Relevance: 2.0, Strings: 1, Instructions: 789COMMON

Download Yara Rule

Strings

VUUU, xrefs: 6C89EE3F

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID: VUUU
API String ID: 0-2040033107
Opcode ID: 2604000cd0004c16fdb9ceac9a95627f5af079a80199fed19584c436e00a20a2
Instruction ID: fc996760de3436d031a61ec9be81dd12ccdd5afa78835d6184a566f9c852aaad
Opcode Fuzzy Hash: 2604000cd0004c16fdb9ceac9a95627f5af079a80199fed19584c436e00a20a2
Instruction Fuzzy Hash: 0B62FF756093458FC328DF2DC580A5AFBE0BBD9308F444E2EF99997750E770E9498B82

Function 6C8A6CC0 Relevance: 2.0, Strings: 1, Instructions: 705COMMON

Download Yara Rule

Strings

SvTq, xrefs: 6C8A70DF

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID: SvTq
API String ID: 0-1364570696
Opcode ID: cf04ec993b973b82635e86b3f3483075bf4f148e75deec9b584add79634cf65d
Instruction ID: 9ec7852df33a67dfb30db024884043864e6e4c4e41478662c78309c64fceed4e
Opcode Fuzzy Hash: cf04ec993b973b82635e86b3f3483075bf4f148e75deec9b584add79634cf65d
Instruction Fuzzy Hash: 065241716083458FD328CF5DC98075ABBE1FBC8704F444A2DE9998B781DB75E90ACB82

Function 6C8A5C00 Relevance: 1.9, Strings: 1, Instructions: 666COMMON

Download Yara Rule

Strings

3, xrefs: 6C8A5FA9

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 3d801ced321bc1ffe709cbc5afb1237966166e890358fae12e5b08e93e965640
Instruction ID: dc394fabd3b46d36a46de6c921d5fe8b4359a63d5a6dce203b47745fbae2f793
Opcode Fuzzy Hash: 3d801ced321bc1ffe709cbc5afb1237966166e890358fae12e5b08e93e965640
Instruction Fuzzy Hash: 5562FE71A087428FC324CF18C580A5AFBE1BFC8708F558A6DE99997715D770E94ACF82

Function 6C8A9C30 Relevance: 1.8, Strings: 1, Instructions: 600COMMON

Download Yara Rule

Strings

SvTq, xrefs: 6C8A9EB2

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID: SvTq
API String ID: 0-1364570696
Opcode ID: cf058576d9bc9576b5f014c92dd2659eea84f64bddf14d1d409b067a24d2ba3f
Instruction ID: 1f2b35f19b60cb12500f1a3dd5ae3c810eaeeba1c6d00a3eb57c18ec09a949a4
Opcode Fuzzy Hash: cf058576d9bc9576b5f014c92dd2659eea84f64bddf14d1d409b067a24d2ba3f
Instruction Fuzzy Hash: 1A325A716083469FC724CF68C980A9BB7E5FFC9304F144E2EE59997610E731E94ACB92

Function 00AF61BC Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00AF6222), ref: 00AF61E2

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8840fc92cd4f552192d9553d398fe8154e67565b36fac0150d4000038845c7f3
Instruction ID: cbf2f988a2c1ebf6939a723c4bb40d44b1f433804cb56860d5263e1d333497f6
Opcode Fuzzy Hash: 8840fc92cd4f552192d9553d398fe8154e67565b36fac0150d4000038845c7f3
Instruction Fuzzy Hash: 08F04F30E0420DAFEB15EEE5CD42AFEB77AFB89710F408975B21096590E7B42A44C694

Function 6C8A4EB0 Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9599cec7d9f4b913050ac1edeaead7312e031f049a4175d95f1c5c54462243
Instruction ID: 9e4f0ccf70aeb4e54338d823645801b6c9adcfdd4b430b15d8fefe5f5a043fe1
Opcode Fuzzy Hash: 5d9599cec7d9f4b913050ac1edeaead7312e031f049a4175d95f1c5c54462243
Instruction Fuzzy Hash: 60624471A087459FC724CF68C980A5BBBE5FFC9308F044A2DE98997711D731E94ACB92

Function 6C8B4D30 Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae72de72c95ac2a84dc111f354ad7d2a2a009d1e89e4579436794fcc69f45df
Instruction ID: 7ca9a30ca05d6c8b0a61f306ce60e40424277aebf1ad63ecc2287576215cef59
Opcode Fuzzy Hash: 4ae72de72c95ac2a84dc111f354ad7d2a2a009d1e89e4579436794fcc69f45df
Instruction Fuzzy Hash: 9C7262B5A48B448FD354CF2AC585A4AFBE2FFD8704F248A2DE59987764D331E8418F42

Function 6C88CCD0 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bff860c3a023e3812474067f976ccfd296e62bfc81306399aa399fdc1aa28d
Instruction ID: 53f78a725faaf31b492129bfb84fc8bb4166950280d7f2a78a47edfb3272b850
Opcode Fuzzy Hash: a4bff860c3a023e3812474067f976ccfd296e62bfc81306399aa399fdc1aa28d
Instruction Fuzzy Hash: DE22F1716063069FE7309F29CA80B66B7E5EF85708F544E2EE886C7E45E334E5488B91

Function 6C89ACD0 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a90f2afa88ac95b9966176619f375e8693a31fd1a077eee55b740097d5d15bf
Instruction ID: 03b395dcfa13be3c7e403053555c6601495f25b23e64df44399e83f927347a47
Opcode Fuzzy Hash: 4a90f2afa88ac95b9966176619f375e8693a31fd1a077eee55b740097d5d15bf
Instruction Fuzzy Hash: DDE19F327156268BCB24CF2DD88017BB3E6FEC93167098A3AE945D7254FB39D655C380

Function 6C8AED80 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8fae780ef6d909120ba81b3a22a8206c2b60666ca6f0aed5938e20160ef453
Instruction ID: 8ccf9bfd875aca3fa1a3a929066077199d88239c968c4db55afd42f49c1bb287
Opcode Fuzzy Hash: 2e8fae780ef6d909120ba81b3a22a8206c2b60666ca6f0aed5938e20160ef453
Instruction Fuzzy Hash: E4C1D3F3A042006BE3349798CD93FFBB3D4AB94344F844E29E05695BC0FB79A6594786

Function 6C8B7E80 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5886400945f62e640b7aca601df0ed852ab5771437386ac562598905bb08fdf2
Instruction ID: 9db934d4c68ec2b0c44c26c27d4fb3b1929c4b8ad818ad4b726df0c1ad14a7e8
Opcode Fuzzy Hash: 5886400945f62e640b7aca601df0ed852ab5771437386ac562598905bb08fdf2
Instruction Fuzzy Hash: B8C1ACB5A083468FD308CF19D581A1AFBE2FF98304F18492EF49997751D331E949CB96

Function 6C8DDDA0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06beb75dbb4b45a234c34b4d7b5d475ac3b88f36d54ab3333beea7c8e6a0840e
Instruction ID: cab87267b061475cd8692a843481c2a51ad036a5ad7a41577ca3c4203fa71237
Opcode Fuzzy Hash: 06beb75dbb4b45a234c34b4d7b5d475ac3b88f36d54ab3333beea7c8e6a0840e
Instruction Fuzzy Hash: A5516E7370421A4B872CDD6DCD5026EB3D2ABC4309F1A8B3EE892D7B85D934E8098791

Function 6C8CED20 Relevance: 15.2, APIs: 10, Instructions: 167COMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100002,00000000,00000000,449EB355), ref: 6C8CEDC5
CloseHandle.KERNEL32(00000000), ref: 6C8CEDDA
ResetEvent.KERNEL32(00000000,449EB355), ref: 6C8CEDE4
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6C8CEE31
CloseHandle.KERNEL32(00000000), ref: 6C8CEE46
SetEvent.KERNEL32(00000000), ref: 6C8CEE55
CloseHandle.KERNEL32(00000000,449EB355), ref: 6C8CEE68
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,449EB355), ref: 6C8CEEBF
CloseHandle.KERNEL32(00000000), ref: 6C8CEED4
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,449EB355), ref: 6C8CEEE6

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: Event$CloseHandle$Create$ObjectOpenResetSingleWait
String ID:
API String ID: 3951656645-0
Opcode ID: 78907af16882ba30784c4dd1d173687ee0623176595aef9ac9042bd29717dbec
Instruction ID: e59c6b06e0e89b064f216d155d5b2915d5ea5e5b7f6b0e005b6acfe9f0f23333
Opcode Fuzzy Hash: 78907af16882ba30784c4dd1d173687ee0623176595aef9ac9042bd29717dbec
Instruction Fuzzy Hash: 43517F71E0535CABDF21CBE9C945B9EB7B8AF09719F104619E828AB680D730D905CBD2

Function 00B36184 Relevance: 13.6, APIs: 9, Instructions: 150COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00B361BD
MulDiv.KERNEL32(?,?,?), ref: 00B361D7
MulDiv.KERNEL32(?,?,?), ref: 00B36205
MulDiv.KERNEL32(?,?,?), ref: 00B3621B
MulDiv.KERNEL32(?,?,?), ref: 00B36253
MulDiv.KERNEL32(?,?,?), ref: 00B3626B
MulDiv.KERNEL32(?,?,0000001F), ref: 00B362B5
MulDiv.KERNEL32(?,?,0000001F), ref: 00B362DE
MulDiv.KERNEL32(00000000,?,0000001F), ref: 00B36304

Part of subcall function 00B11B9C: MulDiv.KERNEL32(00000000,?,00000048), ref: 00B11BA9

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfacf1816af764f46010077fa48923bf8848788164ee88afd2da78d09301ae16
Instruction ID: ede6cce74a7afc734105cc016242e3c2b7b4a6a1faa945c64c00cbf90333e66e
Opcode Fuzzy Hash: dfacf1816af764f46010077fa48923bf8848788164ee88afd2da78d09301ae16
Instruction Fuzzy Hash: DB510871608740BFC320EBA9C985B6BBBE9AF49740F248C5DF9D6C7352C635E8448B60

Function 6C8BCCE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6C8BCD17
___except_validate_context_record.LIBVCRUNTIME ref: 6C8BCD1F
_ValidateLocalCookies.LIBCMT ref: 6C8BCDA8
__IsNonwritableInCurrentImage.LIBCMT ref: 6C8BCDD3
_ValidateLocalCookies.LIBCMT ref: 6C8BCE28

Strings

csm, xrefs: 6C8BCDBD

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4dbf197999cd6eff70da2cc5dbc361ab2caa2e43a3a491e0d0fe1e3500a246b9
Instruction ID: 16aa4e00de601e14ef45b502f1522438f361279218b98a2dcc3bbee5f3e234fa
Opcode Fuzzy Hash: 4dbf197999cd6eff70da2cc5dbc361ab2caa2e43a3a491e0d0fe1e3500a246b9
Instruction Fuzzy Hash: 6C41B434A00219ABCF20DF6DC980ADEBFB5EF45318F148966E824BB756D731E915CB90

Function 6C8C3C03 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6C8C3D12,?,?,00000000,6C8BB016,?,?,6C8C3E8B,00000022,FlsSetValue,6C9182F8,6C918300,6C8BB016), ref: 6C8C3CC4

Strings

api-ms-, xrefs: 6C8C3C5A
ext-ms-, xrefs: 6C8C3C6E

Memory Dump Source

Source File: 00000003.00000002.3530657977.000000006C881000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C880000, based on PE: true

Associated: 00000003.00000002.3530606842.000000006C880000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531323634.000000006C8EF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531674787.000000006C921000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3531785216.000000006C923000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c880000_AudioReaderXL.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5c11510621d2ede501de6ad73d9cc51af402ab575cefdfad1705b3b0650ac70e
Instruction ID: d673ac2583b7f1277e01fca74c25201468650be8a051ad69e06a56381cefbdc3
Opcode Fuzzy Hash: 5c11510621d2ede501de6ad73d9cc51af402ab575cefdfad1705b3b0650ac70e
Instruction Fuzzy Hash: CA213D31B85214A7C7318735DD44ACE33789F42378F260A20E915A7A80D734EE06C6D2

Function 00B300AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoA.USER32(00000000,00000000,000000FF), ref: 00B300FA
SetMenuItemInfoA.USER32(00000000,00000000,000000FF), ref: 00B3014C
DrawMenuBar.USER32(00000000), ref: 00B30159

Strings

P, xrefs: 00B300EC

Memory Dump Source

Source File: 00000003.00000002.3501414623.0000000000AF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000003.00000002.3501392560.0000000000AF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501797081.0000000000B47000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3501860351.0000000000B4D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_af0000_AudioReaderXL.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: P
API String ID: 3227129158-3110715001
Opcode ID: 66fc518a50f989ec40ab0f482acd392ce6f56dc7bc4908b56582a2e6b7d9e64e
Instruction ID: b1c5e4f21e83b85f22ccfd0cadd8f18a8791fa9f599a5247b62deb0d14d7846e
Opcode Fuzzy Hash: 66fc518a50f989ec40ab0f482acd392ce6f56dc7bc4908b56582a2e6b7d9e64e
Instruction Fuzzy Hash: 1711E3306156046FD720EF28CC81B5B7AD5EF84364F248668F1A8DB3E9D775C988C786

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cloudflare.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\47502b.rbs

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\ABCpdf.dll

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\AudioReaderXL.exe

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CharcoalDarkSlate.vsf

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\CloseApplication.dll

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Concept.dat

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Insurance.db

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Languages\Russian.sib

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License-Russian.txt

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\License.txt

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,1.dll

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\Notifications,2.dll

C:\Users\user\AppData\Local\Programs\Audio Reader XL Premium\PDFtext.dll

Windows Analysis Report
cloudflare.msi

Function 00AF5858 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre