Windows Analysis Report
MEuu1a2o6n.exe

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7440:120:WilError_03

Source: MEuu1a2o6n.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: MEuu1a2o6n.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe

File read: C:\Users\user\Desktop\MEuu1a2o6n.exe

Source: unknown	Process created: C:\Users\user\Desktop\MEuu1a2o6n.exe "C:\Users\user\Desktop\MEuu1a2o6n.exe"
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\Update.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\Update.exe C:\Users\Public\Bilite\Axialis\Update.exe
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\Update.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\Update.exe C:\Users\Public\Bilite\Axialis\Update.exe	Jump to behavior

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: update.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Section loaded: cscapi.dll	Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Source: ChromeSetup.exe.lnk.3.dr

LNK file: ..\..\Public\Bilite\ChromeSetup.exe

Source: MEuu1a2o6n.exe

Static file information: File size 73957257 > 1048576

Source:	Binary string: UpdaterSetup.exe.pdb source: MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.0.dr
Source:	Binary string: \YSS\Release\Update.pdb source: MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000003.00000002.1783209928.000000006BF1A000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: E:\agent\workspace\p-e3cf6c00cb1d4f41832c02872427999a\src\Ufo4WinMac\GamerUFO\ufo4Desktop\Output\bin\Release\UpdateApp.pdb source: MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000003.00000000.1778938696.0000000000432000.00000002.00000001.01000000.00000005.sdmp, Update.exe, 00000003.00000002.1782606665.0000000000432000.00000002.00000001.01000000.00000005.sdmp, Update.exe.0.dr
Source:	Binary string: UpdaterSetup.exe.pdbP source: MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.0.dr
Source:	Binary string: E:\agent\workspace\p-e3cf6c00cb1d4f41832c02872427999a\src\Ufo4WinMac\GamerUFO\ufo4Desktop\Output\bin\Release\UpdateApp.pdb((& source: MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000003.00000000.1778938696.0000000000432000.00000002.00000001.01000000.00000005.sdmp, Update.exe, 00000003.00000002.1782606665.0000000000432000.00000002.00000001.01000000.00000005.sdmp, Update.exe.0.dr
Source:	Binary string: \YSS\Release\Update.pdbp: source: MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000003.00000002.1783209928.000000006BF1A000.00000002.00000001.01000000.00000006.sdmp

Source: Update.dll.0.dr	Static PE information: section name: .00cfg
Source: ChromeSetup.exe.0.dr	Static PE information: section name: CPADinfo
Source: ChromeSetup.exe.0.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Code function: 0_2_0088E400 push esi; ret	0_2_0088E401
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Code function: 0_2_0088CE30 push es; ret	0_2_0088CE51
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Code function: 0_2_0088BCD9 push esp; ret	0_2_0088BD19
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BD9F210 push eax; mov dword ptr [esp], 8007000Eh	3_2_6BD9F214
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDE18F6 pushfd ; retf	3_2_6BDE18F7
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDE188A pushfd ; retf	3_2_6BDE188B
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDAF863 push esi; ret	3_2_6BDAF865
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDBF1ED push ecx; ret	3_2_6BDBF200

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	File created: C:\Users\Public\Bilite\Axialis\Update.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	File created: C:\Users\Public\Bilite\ChromeSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	File created: C:\Users\Public\Bilite\Axialis\Update.exe	Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDC2B1D GetParent,IsIconic,GetParent,__EH_prolog3,	3_2_6BDC2B1D
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDB2D84 IsWindowVisible,IsIconic,	3_2_6BDB2D84
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDA6D7F IsIconic,IsWindowVisible,	3_2_6BDA6D7F
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDD8264 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	3_2_6BDD8264
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDAE40E IsIconic,	3_2_6BDAE40E

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe

Code function: 0_2_0088DC0D sldt word ptr [eax+003A0043h]

0_2_0088DC0D

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe

Dropped PE file which has not been started: C:\Users\Public\Bilite\ChromeSetup.exe

Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\Update.exe

API coverage: 4.4 %

Source: C:\Users\Public\Bilite\Axialis\Update.exe TID: 7504

Thread sleep time: -73000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BEFED8C FindFirstFileExW,RevokeDragDrop,FindNextFileW,FindClose,FindClose,	3_2_6BEFED8C
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BEFECDB FindFirstFileExW,	3_2_6BEFECDB
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDE7D6F __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,	3_2_6BDE7D6F

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Thread delayed: delay time: 73000

Source: xfkiejfk.png.0.dr

Binary or memory string: NHgfS

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Code function: 3_2_004315D0 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_004315D0

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Code function: 3_2_6BDA0AC8 OutputDebugStringA,GetLastError,

3_2_6BDA0AC8

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Code function: 3_2_6BD72590 GetProcessHeap,

3_2_6BD72590

Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_004315D0 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004315D0
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_00431764 SetUnhandledExceptionFilter,	3_2_00431764
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_00431A8F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00431A8F
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BE18246 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6BE18246
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BEF19D8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6BEF19D8
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: 3_2_6BDBD236 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6BDBD236

Source: C:\Users\user\Desktop\MEuu1a2o6n.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\Update.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\Update.exe C:\Users\Public\Bilite\Axialis\Update.exe			Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Code function: 3_2_004318A4 cpuid

3_2_004318A4

Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoW,	3_2_6BDC5B91
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,	3_2_6BF05B73
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: EnumSystemLocalesW,	3_2_6BF05B14
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_6BF058C1
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: EnumSystemLocalesW,	3_2_6BF05826
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,	3_2_6BF05E40
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_6BF05D3A
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,	3_2_6BF05C93
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: EnumSystemLocalesW,	3_2_6BF05C48
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetLocaleInfoW,	3_2_6BEFB18C
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: EnumSystemLocalesW,	3_2_6BEFB7AB
Source: C:\Users\Public\Bilite\Axialis\Update.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_6BF055D5

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Code function: 3_2_004314B7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_004314B7

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Code function: 3_2_6BDA9085 __EH_prolog3_GS,GetCurrentThread,GetCurrentThreadId,GetVersionExW,

3_2_6BDA9085

Source: C:\Users\Public\Bilite\Axialis\Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	21 Input Capture	1 System Time Discovery	Remote Services	21 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MEuu1a2o6n.exe	26%	ReversingLabs	Win32.Trojan.Generic
MEuu1a2o6n.exe	100%	Avira	TR/Crypt.CFI.Gen

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Bilite\Axialis\Update.dll	37%	ReversingLabs	Win32.Backdoor.Farfli
C:\Users\Public\Bilite\Axialis\Update.exe	0%	ReversingLabs
C:\Users\Public\Bilite\ChromeSetup.exe	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	false	high
http://html4/loose.dtd	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.0.dr	false	high
https://sectigo.com/CPS0	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.sectigo.com0	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	false	high
https://m.google.com/devicemanagement/data/api	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.0.dr	false	high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dl.google.com/update2/installers/icons/	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.0.dr	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002B61000.00000004.00000020.00020000.00000000.sdmp	false	high
http://.css	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.0.dr	false	high
http://.jpg	MEuu1a2o6n.exe, 00000000.00000003.1760987934.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.0.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581462
Start date and time:	2024-12-27 20:01:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MEuu1a2o6n.exe renamed because original name is a hash value
Original Sample Name:	B686B0A91C6DA4D4EF4EB9894F41AAEF.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@6/6@0/0
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 38 Number of non-executed functions: 354
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MEuu1a2o6n.exe, PID 7300 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: MEuu1a2o6n.exe

Simulations

Behavior and APIs

Time	Type	Description
14:02:11	API Interceptor	1x Sleep call for process: Update.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\Public\Bilite\ChromeSetup.exe	WiezmDFd6L.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Bilite\ChromeSetup.exe	WiezmDFd6L.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Bilite\Axialis\IiViS

Process:	C:\Users\user\Desktop\MEuu1a2o6n.exe
File Type:	openssl enc'd data with salted password, base64 encoded
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.925118550357139
Encrypted:	false
SSDEEP:	3:iqknz1wReNcIIix+:iliRyIH
MD5:	DF834B315AFBDF1009F18093561F24B0
SHA1:	E6D34AA40B027DFE0770D7EA47EB0F8391FDE9A5
SHA-256:	32627CBBDCD3BCC5FC0A9BFABA8F83D3B0658117E957656C61E6A40F1B3F198E
SHA-512:	26A8B16B1CF69B2EF5B675F4C1AE9CFFAF97AF7B3F5CF04BC7DBB2EA352AFB4D612229F77A4E67CAE1F69CCC289330DAB917D1260E3985B617027E637515CDC1
Malicious:	false
Reputation:	low
Preview:	U2FsdGVkX1+F4WeqPiQSr4Yjb4xJYXlIJqx/6mGhFoo=

C:\Users\Public\Bilite\Axialis\Update.dll

Process:	C:\Users\user\Desktop\MEuu1a2o6n.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2289432
Entropy (8bit):	6.608881172420025
Encrypted:	false
SSDEEP:	49152:5WDF0mklRXopNsAyGrLf2x2umZTltQCv3n89btEQBz68IaV:5Wh0mklRXo7fyGrTw2umjtQCv3nutEQR
MD5:	B1B3A26D557D3FFD4FB1358290A0E13E
SHA1:	763C92A20DB285249F9C043F1249C2C079D45664
SHA-256:	767CD378AF0B0C6B6665DC89078DB9D52D81EBA13AB72B84512A33C912658711
SHA-512:	4F66F9E72634BEC4482ACEDE8D15792710EB5A9FC761603B49EBEA096E88F07F3E92B201A68CCD7882DDE9A6CD5B9408C2F082EFAAB937B7E2C4EAACD030B30C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....sig...........!.........:......S........................................`#...........@.........................<...O.......h..... ..H............"..)... !..0..\........................b......P................................................text............................... ..`.rdata...].......^..................@..@.data...@..... ..^..................@....00cfg........ ......H .............@..@.tls.......... ......J .............@....rsrc....H.... ..H...L .............@..@.reloc...0... !..2.... .............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Axialis\Update.exe

Process:	C:\Users\user\Desktop\MEuu1a2o6n.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	395368
Entropy (8bit):	5.090673225697451
Encrypted:	false
SSDEEP:	6144:I0acLF3rgypB1Grf/TRfiJ7BePaEvLJggZy:Y/TRfi3ePtJRg
MD5:	FB325C945A08D06FE91681179BDCCC66
SHA1:	F5D91B7D75D34E156066AB4099E0FD0DF9227B32
SHA-256:	0C2CC4513EC9101A28A7988C72A46175EFD82F387BB3BCFB2612E808804282B5
SHA-512:	2BB588EBE2FA35D03652AEC4E5D51DABD3A24E996336A4D5EC9C762D6084862D5CD5F530F1DA0B98D2887BA88F4E077697D128071FF497D2967F9F42ADC2F533
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:..[...[...[...#l..[.......[.......[.......[.......[..b....[..e....[...0...[...[...[..e....[..e....[...[h..[..e....[..Rich.[..........................PE..L...X..e............................\........ ....@..................................8....@.................................D(.......@..................h(...........!..T............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0.......$..............@....rsrc........@.......&..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Axialis\xfkiejfk.png

Process:	C:\Users\user\Desktop\MEuu1a2o6n.exe
File Type:	data
Category:	dropped
Size (bytes):	69947528
Entropy (8bit):	7.999995221278417
Encrypted:	true
SSDEEP:	1572864:MAm4Pz2HsA8kQp53/qIgnsCisxhhvxTLhAeXDxv4i/d3AC+ZL:Mjoz98QbPqIgnsCisxhhJlAeXDxvVgL
MD5:	F3BECB4772D5FFDA3B45506E796FE4CE
SHA1:	CC14A431A7D6C64CFE0683E0333869959515C587
SHA-256:	3FDC78A3A74C8BA0C37093AA1308FD2A439CA44052B4E9EF83CC5E90C1589BD6
SHA-512:	D9334E287A750235BC13AB11F8E3760467CDAB8CE108ECE9DEFAFBA07D60094D3B20EFBD31C61296BA7E7BEC7A1EE67F1BD5E75F99E0E831FE74A48D43FB8357
Malicious:	false
Reputation:	low
Preview:	..>.....x...@..{)`B...............F......P j.~.%.c..J2,j.nXj~.._.O...h...$........F)d...\|."......G..T..R+Ikt.0'.q..8..9\..b[.H...d.3i.ly ..D.l..0D.!...69...M.!-{nX.....:k.".h...e.G..NN.W.m.+..`.......[..5.ZL...v.6.\2..k.t.....!k...j..pX...S.<.YD^i@...,.PMy..B.....#^uR.M....K...g.f.....1....k."..&$..XY....@...?..R:.........@.Q\|.)D..C...U.V.(.D..lYHh....~o.%B..}.=.;X)6...h....v.......{J<7X)....$H[.]^...._].sq....M.........<..`a&Y=.@S...}Z.%...<..S..v]..'Ri.....`{..:.......9....F.s.]s.(OC8.....u.&2.Ugw}.-..4..i.0..Vcg..]..t.{....z.}...@)).@....v.*.K....D...X%._.t.b.)B.o....fp._.M..#..d...Q...dgI..j#.k.T.....).'MP;.........:......,s......_.&m....v.a$M..!...L-.\|Z.c.6....A..j'...K..4...v.%..C..E.h.C...P......A-S..\.......7..v....a...H...\|.Om....1....E..\...6.#.:f.^.N....N.r..\v.[.....$..C.....c....P!x......%.d...B...d.A.......Sv.8.D..h^....4.S.yb2.r.5er..\|{.HA<.".>.v.?...R..S<{QR..8...;..&F.=.6f..._u...fc(.G..m..,..T.f/..t

C:\Users\Public\Bilite\ChromeSetup.exe

Process:	C:\Users\user\Desktop\MEuu1a2o6n.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10384768
Entropy (8bit):	6.780996075213578
Encrypted:	false
SSDEEP:	196608:VpjYZ94Z6AhJ5NtGdDDIauMJZZCgdaTos7s4QA/rmYeus5dvXCKsJdVV3qHDYyY2:VpjwKZF5LGdDDvJZZCgdwbcAheus5xXB
MD5:	C8B07E0F9BA7C97B55CB29835FFAF5F6
SHA1:	9FFFC728C361DCDD4828212F1F0E56A0DAC92463
SHA-256:	A68355D5F7E99F3BE66D84EA5AD4A72F92D1611C53F959C0B4E742B363678578
SHA-512:	0AB0D39F0FBCDB11E241AE95CC540A54EF4D9A6E611AE516EF189627E73505696AEBEDACE7D4527C40F31A021850CB7CB563F4D0CE0411BE2F9B87ABA2493866
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: WiezmDFd6L.exe, Detection: malicious, Browse Filename: WiezmDFd6L.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g.........."......T4...i...................@......................................@.........................<.=.U.....=.@.....@..H^..........,...I...`.......k=.....................Pi=......q4.............@.=.l............................text....S4......T4................. ..`.rdata..`....p4......X4.............@..@.data........ >..R....=.............@....tls....u.....?......N>.............@...CPADinfo(.....?......P>.............@...malloc_h......@......R>............. ..`.rsrc....H^...@..H^..T>.............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\ChromeSetup.exe.lnk

Process:	C:\Users\Public\Bilite\Axialis\Update.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Dec 27 18:02:09 2024, mtime=Fri Dec 27 18:02:09 2024, atime=Sun Dec 8 12:55:51 2024, length=10384768, window=hide
Category:	dropped
Size (bytes):	1056
Entropy (8bit):	4.714683537886547
Encrypted:	false
SSDEEP:	12:8GIGpUlGIwCICHqXbRXyACmq2PxXlFTXjEjAJslGlHavoo44t2YZ/elFlSJmZmV:8GWG7V9JDXUAJsDvo3qyFm
MD5:	068402181EDD92F80B4EC08996FDB6DE
SHA1:	C6626DF0000FD7FE62DEA22C3486F4C99D4214AE
SHA-256:	C462778433FAAE1DA50CE44E911B99AC258DB20DC45A52F676398C3673E93CC7
SHA-512:	C6FD253B5661F55CDC9CB32F6A634387928D4BD1F7F2085EEC790F6E8777276C082768EAA69B6BB337898ED758C46857994CB8917C25D15C779CE779F4B7E578
Malicious:	false
Preview:	L..................F.... ...v.J.X..K.d.X...@.xI...u...........................P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH.Y=.....................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......Y@...Public..f......O.I.Y@.....+...............<.....'.).P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....T.1......YE...Bilite..>......Y@..YE.............................n.B.i.l.i.t.e.....l.2..u...Y.n .CHROME~1.EXE..P......YE..YE..........................."e{.C.h.r.o.m.e.S.e.t.u.p...e.x.e.......U...............-.......T...................C:\Users\Public\Bilite\ChromeSetup.exe..#.....\.....\.P.u.b.l.i.c.\.B.i.l.i.t.e.\.C.h.r.o.m.e.S.e.t.u.p...e.x.e..........v..*.cM.jVD.Es.!...`.......X.......927537...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9999862599196385
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MEuu1a2o6n.exe
File size:	73'957'257 bytes
MD5:	b686b0a91c6da4d4ef4eb9894f41aaef
SHA1:	d5376faea233ddf3d41de066c35b8a51b88c2d02
SHA256:	cea23cddf4b3ab0e7a61377df8dd847b52a7dd84ba5a3a6a3e547f329a5d29fa
SHA512:	8b3fe6da763b6ddd3303c454bc904dc7e1632e34651d1a1b82e8fae104742f74c2b435d87c0231103eb73712feb19d2434fd665f95fa0b7509a270503de617ab
SSDEEP:	1572864:hvZ64UFS44SPDVZpy+1gwFIFhRMNSu8pxpwY9muH4dPuf29k4:hvZ6pbZPDVm3hSN5aIY9zH4xufj4
TLSH:	F0F733FEC2E39800D18A36F5F59DEF65D6EF80B8CB05A7026C80D9229952E51D74FB60
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................................0....@.......................... ......y\|.......................................P...........z.................

File Icon


Icon Hash:	674e4f45a7297639

Static PE Info

General

Entrypoint:	0x411def
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4C26F87E [Sun Jun 27 07:06:38 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b5a014d7eeb4c2042897567e1288a095

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00414C50h
push 00411F80h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00413184h]
pop ecx
or dword ptr [00419924h], FFFFFFFFh
or dword ptr [00419928h], FFFFFFFFh
call dword ptr [00413188h]
mov ecx, dword ptr [0041791Ch]
mov dword ptr [eax], ecx
call dword ptr [0041318Ch]
mov ecx, dword ptr [00417918h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00413190h]
mov eax, dword ptr [eax]
mov dword ptr [00419920h], eax
call 00007F86D0B3BF02h
cmp dword ptr [00417710h], ebx
jne 00007F86D0B3BDEEh
push 00411F78h
call dword ptr [00413194h]
pop ecx
call 00007F86D0B3BED4h
push 00417048h
push 00417044h
call 00007F86D0B3BEBFh
mov eax, dword ptr [00417914h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00417910h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041319Ch]
push 00417040h
push 00417000h
call 00007F86D0B3BE8Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x150dc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x7aae	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x310	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11317	0x11400	797279c5ab1a163aed1f2a528f9fe3ce	False	0.6174988677536232	data	6.576987441854239	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x30ea	0x3200	1359639b02bcb8f0a8743e6ead1c0030	False	0.43828125	data	5.549434098115495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x292c	0x800	9415c9c8dea3245d6d73c23393e27d8e	False	0.431640625	data	3.6583182363171756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a000	0x7aae	0x7c00	681924a1176975a6419cbf4cfcb9eeb5	False	0.8595325100806451	data	7.469162062602366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a304	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41397849462365593
RT_STRING	0x1a5ec	0x278	data			0.3212025316455696
RT_STRING	0x1a864	0x328	data			0.3910891089108911
RT_STRING	0x1ab8c	0xe4	data			0.5482456140350878
RT_STRING	0x1ac70	0xbc	data			0.5691489361702128
RT_STRING	0x1ad2c	0x2dc	data			0.44808743169398907
RT_STRING	0x1b008	0x3b4	data			0.38396624472573837
RT_STRING	0x1b3bc	0x2c4	data			0.4166666666666667
RT_RCDATA	0x1b680	0x10	data			1.5
RT_RCDATA	0x1b690	0x360	data			0.6944444444444444
RT_GROUP_ICON	0x1b9f0	0x14	data	English	United States	1.2
RT_VERSION	0x1ba04	0x324	data	English	United States	0.4552238805970149

Imports

DLL	Import
COMCTL32.dll
KERNEL32.dll	GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, LoadLibraryA, LockResource, LoadResource, SizeofResource, FindResourceExA, MulDiv, GlobalFree, GlobalAlloc, lstrcmpiA, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, MultiByteToWideChar, GetLocaleInfoW, lstrlenA, lstrcmpiW, GetEnvironmentVariableW, lstrcmpW, GlobalMemoryStatusEx, VirtualAlloc, WideCharToMultiByte, ExpandEnvironmentStringsW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, SetThreadLocale, GetLocalTime, GetSystemTimeAsFileTime, lstrlenW, GetTempPathW, SetEnvironmentVariableW, CloseHandle, CreateFileW, GetDriveTypeW, SetCurrentDirectoryW, GetModuleFileNameW, GetCommandLineW, GetVersionExW, CreateEventW, SetEvent, ResetEvent, InitializeCriticalSection, TerminateThread, ResumeThread, SuspendThread, IsBadReadPtr, LocalFree, lstrcpyW, FormatMessageW, GetSystemDirectoryW, DeleteCriticalSection, GetFileSize, SetFilePointer, ReadFile, SetFileTime, SetEndOfFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleHandleA, SystemTimeToFileTime, GetLastError, CreateThread, WaitForSingleObject, GetExitCodeThread, Sleep, SetLastError, SetFileAttributesW, GetDiskFreeSpaceExW, lstrcatW, ExitProcess, CompareFileTime, GetStartupInfoA
USER32.dll	CharUpperW, EndDialog, DestroyWindow, KillTimer, ReleaseDC, DispatchMessageW, GetMessageW, SetTimer, CreateWindowExW, ScreenToClient, GetWindowRect, wsprintfW, GetParent, GetSystemMenu, EnableMenuItem, EnableWindow, MessageBeep, LoadIconW, LoadImageW, wvsprintfW, IsWindow, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, SetFocus, SetWindowLongW, GetSystemMetrics, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, wsprintfA, SetWindowTextW, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, CopyImage, SendMessageW, GetWindowDC
GDI32.dll	GetCurrentObject, StretchBlt, SetStretchBltMode, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetObjectW, GetDeviceCaps, DeleteObject, CreateFontIndirectW, DeleteDC
SHELL32.dll	SHGetFileInfoW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, SHGetSpecialFolderPathW, ShellExecuteW
ole32.dll	CoInitialize, CreateStreamOnHGlobal, CoCreateInstance
OLEAUT32.dll	VariantClear, OleLoadPicture, SysAllocString
MSVCRT.dll	__set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, memset, _wcsnicmp, strncmp, malloc, memmove, _wtol, memcpy, free, memcmp, _purecall, ??2@YAPAXI@Z, ??3@YAXPAX@Z, _except_handler3, _controlfp

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	14:01:59
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\MEuu1a2o6n.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MEuu1a2o6n.exe"
Imagebase:	0x400000
File size:	73'957'257 bytes
MD5 hash:	B686B0A91C6DA4D4EF4EB9894F41AAEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	14:02:11
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\Update.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	14:02:11
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	14:02:11
Start date:	27/12/2024
Path:	C:\Users\Public\Bilite\Axialis\Update.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Bilite\Axialis\Update.exe
Imagebase:	0x430000
File size:	395'368 bytes
MD5 hash:	FB325C945A08D06FE91681179BDCCC66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true