Windows Analysis Report
Fqae7BLq4m.exe

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:616:120:WilError_03

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Command line argument: Np

4_2_00EB6F90

Source: Fqae7BLq4m.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Fqae7BLq4m.exe	Virustotal: Detection: 19%
Source: Fqae7BLq4m.exe	ReversingLabs: Detection: 26%

Source: RuntimeBrokers.exe	String found in binary or memory: --StartTask
Source: RuntimeBrokers.exe	String found in binary or memory: --InstallTask
Source: RuntimeBrokers.exe	String found in binary or memory: --stop
Source: RuntimeBrokers.exe	String found in binary or memory: --start
Source: RuntimeBrokers.exe	String found in binary or memory: --install

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

File read: C:\Users\user\Desktop\Fqae7BLq4m.exe

Source: unknown	Process created: C:\Users\user\Desktop\Fqae7BLq4m.exe "C:\Users\user\Desktop\Fqae7BLq4m.exe"
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to behavior

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: libcurl.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: Firefox Setup 132.0.2.exe.lnk.4.dr

LNK file: ..\..\Public\Bilite\Firefox Setup 132.0.2.exe

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Fqae7BLq4m.exe

Static file information: File size 70322189 > 1048576

Source:	Binary string: \YSS\Release\libcurl.pdb source: RuntimeBrokers.exe, 00000004.00000002.4518787647.000000006C41A000.00000002.00000001.01000000.00000006.sdmp, libcurl.dll.0.dr
Source:	Binary string: G:\ZCSD\XZRecordAlone\xzrecordalone\Release\XZCalendarServer.pdb source: RuntimeBrokers.exe, 00000004.00000000.2165191641.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000004.00000002.4516146435.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe.0.dr

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: libcurl.dll.0.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Code function: 0_2_00411C20 push eax; ret	0_2_00411C4E
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E455E9 push ebx; retf	4_2_00E455EA
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E7C7E6 push ecx; ret	4_2_00E7C7F9
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E7BEE2 push ecx; ret	4_2_00E7BEF5
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C29F770 push eax; mov dword ptr [esp], 8007000Eh	4_2_6C29F774
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C2E0E84 pushfd ; retf	4_2_6C2E0E85
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C2AFDC3 push esi; ret	4_2_6C2AFDC5
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C2BF74D push ecx; ret	4_2_6C2BF760

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	File created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	File created: C:\Users\Public\Bilite\Firefox Setup 132.0.2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	File created: C:\Users\Public\Bilite\Axialis\libcurl.dll	Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C2AE96E IsIconic,	4_2_6C2AE96E
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C2D87C4 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	4_2_6C2D87C4
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C2C307D GetParent,IsIconic,GetParent,__EH_prolog3,	4_2_6C2C307D

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

Process information set: NOOPENFILEERRORBOX

Query firmware table information (likely to detect VMs)

Malware Analysis System Evasion

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

System information queried: FirmwareTableInformation

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,

4_2_00E76390

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 820	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 3832	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 3552	Jump to behavior

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

Dropped PE file which has not been started: C:\Users\Public\Bilite\Firefox Setup 132.0.2.exe

Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_4-111590
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_4-111127

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

API coverage: 6.4 %

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 5440	Thread sleep time: -73000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 7164	Thread sleep time: -2460000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 7164	Thread sleep time: -10656000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Code function: 0_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	0_2_0040301A
Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Code function: 0_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402B79
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E4BE70 GetLocalTime,FindFirstFileA,FindNextFileA,DeleteFileA,FindNextFileA,__Mtx_destroy_in_situ,__Mtx_destroy_in_situ,	4_2_00E4BE70
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00EAF4E8 FindFirstFileExA,	4_2_00EAF4E8
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C2E82CF __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,	4_2_6C2E82CF

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Thread delayed: delay time: 73000

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00E7B4C5 IsDebuggerPresent,OutputDebugStringW,

4_2_00E7B4C5

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_6C2A1028 OutputDebugStringA,GetLastError,

4_2_6C2A1028

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00EA46B3 mov eax, dword ptr fs:[00000030h]

4_2_00EA46B3

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00E41AD0 GetProcessHeap,

4_2_00E41AD0

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E7C128 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00E7C128
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E7C411 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00E7C411
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E9655F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00E9655F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C3187A6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6C3187A6
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C3F1F38 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6C3F1F38
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C2BD796 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6C2BD796

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe			Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00E3245C _strrchr,_strrchr,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateEventW,_strrchr,_strrchr,GetModuleHandleW,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,WaitForSingleObject,PeekMessageW,TranslateMessage,DispatchMessageW,WaitForSingleObject,WaitForSingleObject,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,curl_global_cleanup,MoveFileExW,_strrchr,_strrchr,

4_2_00E3245C

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

Code function: 0_2_0040D72E cpuid

0_2_0040D72E

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,	0_2_00401F9D
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_00EB216F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_00EB22FE
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_00EA92B6
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_00EB2263
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_00EB2218
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00EB238B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_00EB25DB
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_00EA979F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00EB2704
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00EB28D8
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_00EB280B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_6C406074
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_6C4060D3
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoW,	4_2_6C2C60F1
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_6C4061F3
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_6C4061A8
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_6C40629A
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_6C4063A0
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_6C3FBD0B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_6C405D86
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_6C405E21
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_6C405B35
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_6C3FB6EC

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

Code function: 0_2_00401626 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_00401626

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00EAC3FF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

4_2_00EAC3FF

Source: C:\Users\user\Desktop\Fqae7BLq4m.exe

Code function: 0_2_00404FAA KiUserCallbackDispatcher,GetVersionExW,GetCommandLineW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,memset,ShellExecuteExW,WaitForSingleObject,CloseHandle,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

0_2_00404FAA

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E8D8C9 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,		4_2_00E8D8C9
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00E8CBF3 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,		4_2_00E8CBF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	21 Input Capture	2 System Time Discovery	Remote Services	21 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Virtualization/Sandbox Evasion	LSASS Memory	13 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Obfuscated Files or Information	LSA Secrets	11 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	35 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fqae7BLq4m.exe	19%	Virustotal		Browse
Fqae7BLq4m.exe	26%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	5%	ReversingLabs
C:\Users\Public\Bilite\Firefox Setup 132.0.2.exe	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	libcurl.dll.0.dr	false	high
https://update-xztodolist.cqttech.com/api/v1/update/checkams	RuntimeBrokers.exe, 00000004.00000002.4516544047.0000000001724000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://dump.mgr.xzdesktop.cqttech.com/api/DumpInfoStat%s_%d-%02d-%02d.log	RuntimeBrokers.exe, 00000004.00000000.2165191641.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000004.00000002.4516146435.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe.0.dr	false	unknown
https://sectigo.com/CPS0	libcurl.dll.0.dr	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	libcurl.dll.0.dr	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	libcurl.dll.0.dr	false	high
http://ocsp.sectigo.com0	libcurl.dll.0.dr	false	high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	libcurl.dll.0.dr	false	high
https://update-xztodolist.cqttech.com/api/v1/update/checkXZDesktopCalendarCXZUpdateModule	RuntimeBrokers.exe, 00000004.00000000.2165191641.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000004.00000002.4516146435.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe.0.dr	false	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	libcurl.dll.0.dr	false	high
https://update-xztodolist.cqttech.com/api/v1/update/check	RuntimeBrokers.exe, RuntimeBrokers.exe, 00000004.00000000.2165191641.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000004.00000002.4516146435.0000000000EBF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe.0.dr	false	unknown
https://update-xztodolist.cqttech.com/api/v1/update/check?version=3.2.7.32&union=4003&os=10.0.19041.	RuntimeBrokers.exe, 00000004.00000002.4516544047.0000000001724000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	libcurl.dll.0.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579418
Start date and time:	2024-12-22 09:31:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Fqae7BLq4m.exe renamed because original name is a hash value
Original Sample Name:	6C547F7A7E7964A03945CEF9BD53E792256E2BEB24E15BE780714AE349C8A81B.exe
Detection:	MAL
Classification:	mal42.evad.winEXE@6/8@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 128 Number of non-executed functions: 266
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:32:15	API Interceptor	32425x Sleep call for process: RuntimeBrokers.exe modified

Process:	C:\Users\user\Desktop\Fqae7BLq4m.exe
File Type:	openssl enc'd data with salted password, base64 encoded
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.033214015923012
Encrypted:	false
SSDEEP:	3:iqk4fCxGrMbP0aCVot1SNGuD:ilcCxG+0aCVO1M
MD5:	50E74B5BC067779E678DB0F2A54DEFC8
SHA1:	13EA01C359FCAE743AC3486C6D3A327E56E63807
SHA-256:	2EEF31B0CCD84C6A3385A75DCCF1F5EFB0285621DAAA4CDC08D04158B603DEAA
SHA-512:	6EF7799A0391D8E9BA12BA937C4585C6C8A42A5C62250C5C8F0F6295043E2A3A587EA259A5C51F9CFD2141DA20878FCA8CE2B902F41624BC42C341D81D8AA40E
Malicious:	false
Reputation:	low
Preview:	U2FsdGVkX19kUlCThJUEb9e23b58qaUiAwjQjHvagtVU8kgm3zdqbwKdbKJmtEKf

C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Process:	C:\Users\user\Desktop\Fqae7BLq4m.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	777816
Entropy (8bit):	6.621348016864403
Encrypted:	false
SSDEEP:	12288:hEj1aAa/zgWDTuE8jegvwIDMuecTenORuFjBw7oHOSgmskduZnTKVrdMujyE3e+0:ooBCoH3BdoTKxdLyAZXdOEvnBzLRUFgi
MD5:	30A274E00DA842B09E9763F19777ADED
SHA1:	848C6A9348020EAEEC1A5674990683A1D9977B80
SHA-256:	9E65D0E8A1BE49EDE20AD53EE1CF57696C99A28D1B058A185818B58B7FD83F66
SHA-512:	81DED3C48D3FFDCF82952922C4B70D5F0945B1B0D5E178A1B552C7D5E8F39D00D3E007D161A7AFBA4502CC5CB2E92DF973902D94C28DF2DE5176FD2F50DE036A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........a............b......b.......b.................................,.................................................Rich............................PE..L.....Wg.........................................@.................................l.....@..........................................p..0...............X(.......{.. (..p...................0).......(..@............................................text............................... ..`.rdata..............................@..@.data....P.......:..................@....rsrc...0....p.......4..............@..@.reloc...{.......\|...:..............@..B................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Axialis\libcurl.dll

Process:	C:\Users\user\Desktop\Fqae7BLq4m.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2290968
Entropy (8bit):	6.605466206867334
Encrypted:	false
SSDEEP:	49152:AWc2Dj3hktNUysuFDbfes+p9bZuR6c3ne3EQBSeoyWF2:Vc2Dj3hkHRsuFP2s+pvuR6c3nKEQBSeD
MD5:	DC10EC7E14FF2DE831C6A08BBA41AD88
SHA1:	56B5E56DA9F3346E4AEE57FB3E29286AFA792F0E
SHA-256:	03ED8F64CDCA65B75F8ACC23EBA7CBBDF1BF2B7446159F07A909CE65BDD553EC
SHA-512:	DB3081C52AA19D8E6E873D532D293D34F83B215F930C11A0A8B99A13D0D5D6966D83EAD1D2AC0C8AA1F480BEFC9B6274B9560A30163276AE1FBD8C40862EC117
Malicious:	false
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....eg...........!.........<.......!.......................................`#...........@............................0.......h..... ..H............"..)... !..0...........................b......P................................................text...m........................... ..`.rdata..._.......`..................@..@.data...@..... ..^..................@....00cfg........ ......N .............@..@.tls.......... ......P .............@....rsrc....H.... ..H...R .............@..@.reloc...0... !..2.... .............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Firefox Setup 132.0.2.exe

Process:	C:\Users\user\Desktop\Fqae7BLq4m.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	68284584
Entropy (8bit):	7.999992371883463
Encrypted:	true
SSDEEP:	1572864:QHms4Lp3eKMWTi1hdM0C49TEX+tWBrhCJOfH:TNlfD46Xh
MD5:	23F241F690F1F73A272EC524FB0537A7
SHA1:	E9C8177734425D5A5544B6BD6BE6D5B4627E1FE1
SHA-256:	F451E97BF0F25CC841366C190F62C8037577EC2EBC5A67DD524396559134F3B8
SHA-512:	8E574C0069B8D3EBE8E43DFFA3DE6A9BECBFDF3681E88801D93FB81AD623490ECA7852DA933198E40F10BAB9E249D8E3509D0AC505575FC151D768E799F03957
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`Y.`Y.`YM.nY.`Y&.dY.`Y..?Y.`Y..=Y.`Y.aYb.`Y&.jY.`Y&.kY..`Yv.fY.`YRich.`Y........................PE..L...9m.[.........................@...O...P...`....@..........................`.............................................L[.......`..L...........X...P5..................................................................0.......................UPX0.....@..............................UPX1.........P......................@....rsrc........`......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.95.UPX!....

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-22.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	5.124551002248184
Encrypted:	false
SSDEEP:	48:oLXX/5epsht6q46EAga8uaP2A28fPeA38XPD:o9/8AJ8fOA28fGA38Xb
MD5:	2FB4ECB24625F18EC2F831286F7A9579
SHA1:	B1CC62EF74AF5A8D0CA5DAF47BD4D12EF0BDA50F
SHA-256:	DAE53B6AE68D02570A5160B52F68B488590F1807DF5B52F770CEC657479C9E66
SHA-512:	4BFF6C767634F7AEED5551F650A34214F4D06CB504CBE153EBE719674064F51986C2829CE7A007E556CEA4A39286D60849AA8081EE02DDFC7B45EFC0CD733ACC
Malicious:	false
Reputation:	low
Preview:	[2024-12-22 04:40:10.135] [info] [5476] [application.cpp Run: 51] curl init res:2..[2024-12-22 04:40:10.146] [info] [5476] [application.cpp Run: 64] CreateEvent [764]..[2024-12-22 04:40:10.149] [info] [5476] [application.cpp Run: 76] CXZShellExecute init..[2024-12-22 04:40:10.150] [info] [5476] [application.cpp Run: 78] CXZUpdateModule init..[2024-12-22 04:40:10.150] [info] [5476] [application.cpp Run: 80] Timer init..[2024-12-22 04:40:10.160] [info] [5476] [application.cpp Run: 82] ServiceMgr Run..[2024-12-22 04:40:10.217] [info] [5476] [application.cpp Run: 84] ThreadPoolMgr Run..[2024-12-22 04:40:10.218] [info] [5476] [application.cpp Run: 87] Running m_hWndAsy:197660..[2024-12-22 04:40:10.218] [info] [5476] [application.cpp Run: 107] Message Loop..[2024-12-22 04:40:19.451] [info] [2788] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-22 04:40:22.333] [error] [2788] [mmcurl.cpp Get: 128] curl init failed..[2024-12-22 04:40:25.484] [info] [2788] [xzupd

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-23.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1018
Entropy (8bit):	5.136786547431531
Encrypted:	false
SSDEEP:	24:oV5hAr/iehFW2jijFzhPWqAr8D6INFW2jD6INPW62Arn39:oxAp8PF1PBAK6c8q6cPH2AL39
MD5:	874C990388AE9A2A6949B8655D590D19
SHA1:	9B16FB05502D7ACAE1C2A5309E55EB15B805B8DF
SHA-256:	27F2BC4BEE41CC7C62AC25361F3504359DA4A983716CE6AAB3B7C47E729843FC
SHA-512:	574BF7C6458AB3627D3587DD0340E3FB1A8BC4BC4BE105E09A8D648CEF3A95B6E82DC20940AE7A9306F201B66D4FF654554A9C5DBEBDE6AA72181D10BB4B733D
Malicious:	false
Reputation:	low
Preview:	[2024-12-23 05:40:33.105] [info] [728] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-23 06:34:48.013] [error] [728] [mmcurl.cpp Get: 128] curl init failed..[2024-12-23 07:50:09.824] [info] [728] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-23 07:50:09.825] [info] [728] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-23 14:06:10.389] [info] [6612] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-23 15:03:07.750] [error] [6612] [mmcurl.cpp Get: 128] curl init failed..[2024-12-23 16:14:53.700] [info] [6612] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-23 16:14:53.700] [info] [6612] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-23 23:01:13.456] [info] [4568] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-23 23:49:47.388] [error] [4568] [mmcurl.cpp Get: 128]

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-24.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.143487473071031
Encrypted:	false
SSDEEP:	12:oVOF2FWqBjFF2kGCpOalL3VArEjvoVxn3VFWqBjxK3VkGCY:oVq2FW2j/2PWXLFArtZFFW2j4FPD
MD5:	948B90E247C0C18074F3A321ED413FDA
SHA1:	942222EB8201AC9E04D1880E40B5C5C594726A4C
SHA-256:	174913EEB7567DBB9E6615246AD1CB00556F2ACA090F0757375BE249E8697844
SHA-512:	A064E6CD0A21D74F4F5EB74197608BA5B3C2FF6C8274C5EAE703C7CA26E5113EE00D97EE26C1F53CACE67362CDC2BDAE689EC05E5E22FA6EF2988C6F49D5269D
Malicious:	false
Reputation:	low
Preview:	[2024-12-24 00:30:32.864] [info] [4568] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-24 00:30:32.869] [info] [4568] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-24 06:33:49.360] [info] [3376] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-24 07:14:10.003] [error] [3376] [mmcurl.cpp Get: 128] curl init failed..[2024-12-24 08:01:48.904] [info] [3376] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-24 08:01:48.905] [info] [3376] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..

C:\Users\user\Desktop\Firefox Setup 132.0.2.exe.lnk

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Dec 22 07:32:03 2024, mtime=Sun Dec 22 07:32:12 2024, atime=Tue Dec 3 12:11:47 2024, length=68284584, window=hide
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.692402331898535
Encrypted:	false
SSDEEP:	12:8eXu0UYluCECHqXeWX1CACmq2Yh+g5FDtYjA4UXJIKGjF0avtaxoxP4t2YZ/elFH:8e7q9AhPDyAT5sdvtu4Fqygm
MD5:	A1D3F27C99FF7768B385131F86A1CA3B
SHA1:	FC595E2AE355E158175A5F9DAC101433B10DB079
SHA-256:	884C382C113E515944364FC8AE783C4E3BA4F943CC1CF833613A5B22F5D8691F
SHA-512:	5EF482444F6B0C23ACE2A4238579ABF227FF48A46C3A36F6702712F9CE33510B590CBF995A4B4FFBC914B203F0E6D480CBC8BA7B99E851827E04E7E4BDD7642A
Malicious:	false
Preview:	L..................F.... ...v...KT..J.^.KT......E...............................P.O. .:i.....+00.../C:\...................x.1.....DW(m..Users.d......OwH.Y.D....................:.....NvM.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......Y.D..Public..f......O.I.Y.D....+...............<.....&..P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....T.1......Y.D..Bilite..>......Y.D.Y.D....Q.........................B.i.l.i.t.e.......2......Yxi .FIREFO~1.EXE..d......Y.D.Y.D....!.....................1.).F.i.r.e.f.o.x. .S.e.t.u.p. .1.3.2...0...2...e.x.e......._...............-.......^..............x.....C:\Users\Public\Bilite\Firefox Setup 132.0.2.exe..-.....\.....\.P.u.b.l.i.c.\.B.i.l.i.t.e.\.F.i.r.e.f.o.x. .S.e.t.u.p. .1.3.2...0...2...e.x.e..........v..*.cM.jVD.Es.!...`.......X.......932923...........hT..CrF.f4... .x.2=.b...,...W..hT..CrF.f4... .x.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999987563129512
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Fqae7BLq4m.exe
File size:	70'322'189 bytes
MD5:	a994f2b3b899758bddf5f35e407a694d
SHA1:	a13dedaceed797a4ee8b399c7db20e88535ab6cc
SHA256:	6c547f7a7e7964a03945cef9bd53e792256e2beb24e15be780714ae349c8a81b
SHA512:	3eb57e03e42b3a0ad54b885f042d70dc2ccd490d493faa0c5f36b5628751d3092ebd986a9ab38e46dd0854257672dddc3bb37a8df4e152776a6306caeabc8d00
SSDEEP:	1572864:T6GU+TLvNqXhlk5jR/7ouTb4CYw1UnxcpMP0s/gH6iERvUUzVwDVuPOtW:Tauehlk/k8ww1UnqpMPHKAUU+gOY
TLSH:	C8F73310E3A057B8F873007D5426CF9BE205ABA757D261637608073B31ADEEFFA065A5
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................N...............0....@..........................................................................P.............................

File Icon


Icon Hash:	878fd7f3b9353593

Static PE Info

General

Entrypoint:	0x411def
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4C26F87E [Sun Jun 27 07:06:38 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b5a014d7eeb4c2042897567e1288a095

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00414C50h
push 00411F80h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00413184h]
pop ecx
or dword ptr [00419924h], FFFFFFFFh
or dword ptr [00419928h], FFFFFFFFh
call dword ptr [00413188h]
mov ecx, dword ptr [0041791Ch]
mov dword ptr [eax], ecx
call dword ptr [0041318Ch]
mov ecx, dword ptr [00417918h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00413190h]
mov eax, dword ptr [eax]
mov dword ptr [00419920h], eax
call 00007F4EA4AD8BD2h
cmp dword ptr [00417710h], ebx
jne 00007F4EA4AD8ABEh
push 00411F78h
call dword ptr [00413194h]
pop ecx
call 00007F4EA4AD8BA4h
push 00417048h
push 00417044h
call 00007F4EA4AD8B8Fh
mov eax, dword ptr [00417914h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00417910h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041319Ch]
push 00417040h
push 00417000h
call 00007F4EA4AD8B5Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x150dc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x13c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x310	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11317	0x11400	797279c5ab1a163aed1f2a528f9fe3ce	False	0.6174988677536232	data	6.576987441854239	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x30ea	0x3200	1359639b02bcb8f0a8743e6ead1c0030	False	0.43828125	data	5.549434098115495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x292c	0x800	9415c9c8dea3245d6d73c23393e27d8e	False	0.431640625	data	3.6583182363171756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a000	0x13c0	0x1400	5293a0fb2c46166ce21247d17e837639	False	0.3568359375	data	4.96958597460067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a250	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.3709677419354839
RT_ICON	0x1a538	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6081081081081081
RT_MENU	0x1a660	0x4a	data	English	United States	0.8648648648648649
RT_DIALOG	0x1a6ac	0xf2	data	English	United States	0.7148760330578512
RT_STRING	0x1a7a0	0x40	data	English	United States	0.59375
RT_GROUP_ICON	0x1a7e0	0x22	data	English	United States	1.0
RT_VERSION	0x1a804	0x314	data	English	United States	0.44416243654822335
RT_MANIFEST	0x1ab18	0x60f	XML 1.0 document, ASCII text, with CRLF line terminators			0.4229529335912315
RT_MANIFEST	0x1b128	0x298	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4894578313253012

Imports

DLL	Import
COMCTL32.dll
KERNEL32.dll	GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, LoadLibraryA, LockResource, LoadResource, SizeofResource, FindResourceExA, MulDiv, GlobalFree, GlobalAlloc, lstrcmpiA, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, MultiByteToWideChar, GetLocaleInfoW, lstrlenA, lstrcmpiW, GetEnvironmentVariableW, lstrcmpW, GlobalMemoryStatusEx, VirtualAlloc, WideCharToMultiByte, ExpandEnvironmentStringsW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, SetThreadLocale, GetLocalTime, GetSystemTimeAsFileTime, lstrlenW, GetTempPathW, SetEnvironmentVariableW, CloseHandle, CreateFileW, GetDriveTypeW, SetCurrentDirectoryW, GetModuleFileNameW, GetCommandLineW, GetVersionExW, CreateEventW, SetEvent, ResetEvent, InitializeCriticalSection, TerminateThread, ResumeThread, SuspendThread, IsBadReadPtr, LocalFree, lstrcpyW, FormatMessageW, GetSystemDirectoryW, DeleteCriticalSection, GetFileSize, SetFilePointer, ReadFile, SetFileTime, SetEndOfFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleHandleA, SystemTimeToFileTime, GetLastError, CreateThread, WaitForSingleObject, GetExitCodeThread, Sleep, SetLastError, SetFileAttributesW, GetDiskFreeSpaceExW, lstrcatW, ExitProcess, CompareFileTime, GetStartupInfoA
USER32.dll	CharUpperW, EndDialog, DestroyWindow, KillTimer, ReleaseDC, DispatchMessageW, GetMessageW, SetTimer, CreateWindowExW, ScreenToClient, GetWindowRect, wsprintfW, GetParent, GetSystemMenu, EnableMenuItem, EnableWindow, MessageBeep, LoadIconW, LoadImageW, wvsprintfW, IsWindow, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, SetFocus, SetWindowLongW, GetSystemMetrics, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, wsprintfA, SetWindowTextW, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, CopyImage, SendMessageW, GetWindowDC
GDI32.dll	GetCurrentObject, StretchBlt, SetStretchBltMode, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetObjectW, GetDeviceCaps, DeleteObject, CreateFontIndirectW, DeleteDC
SHELL32.dll	SHGetFileInfoW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, SHGetSpecialFolderPathW, ShellExecuteW
ole32.dll	CoInitialize, CreateStreamOnHGlobal, CoCreateInstance
OLEAUT32.dll	VariantClear, OleLoadPicture, SysAllocString
MSVCRT.dll	__set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, memset, _wcsnicmp, strncmp, malloc, memmove, _wtol, memcpy, free, memcmp, _purecall, ??2@YAPAXI@Z, ??3@YAXPAX@Z, _except_handler3, _controlfp

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	03:32:02
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\Fqae7BLq4m.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Fqae7BLq4m.exe"
Imagebase:	0x400000
File size:	70'322'189 bytes
MD5 hash:	A994F2B3B899758BDDF5F35E407A694D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	03:32:15
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	03:32:15
Start date:	22/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	03:32:15
Start date:	22/12/2024
Path:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Imagebase:	0xe30000
File size:	777'816 bytes
MD5 hash:	30A274E00DA842B09E9763F19777ADED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low
Has exited:	false