Windows Analysis Report
install.exe

Overview

General Information

Sample Name: install.exe
Analysis ID: 652527
MD5: abc7a9c5b732b72a8f47fd85ee638c09
SHA1: 9876415085f95c02d6bcea9b1fc990d5b5c50d1c
SHA256: d9ebb6958afcd1907651487062108ec56a2af9eb935f2437156584081cb56b2f
Infos:

Detection

Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Yara detected Generic Downloader
Uses 32bit PE files
PE file does not import any functions
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Contains functionality to shutdown / reboot the system
PE file contains sections with non-standard names
Detected potential crypto function
Found dropped PE file which has not been started or loaded
Contains functionality for read data from the clipboard

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: install.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: install.exe Virustotal: Detection: 34% Perma Link
Source: install.exe ReversingLabs: Detection: 54%
Multi AV Scanner detection for domain / URL
Source: wjecpujpanmwm.tk Virustotal: Detection: 8% Perma Link
Uses 32bit PE files
Source: install.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\LICENSE.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\adodbapi\license.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\adodbapi\readme.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\isapi\README.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\isapi\samples\README.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\isapi\test\README.txt Jump to behavior
Source: install.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: MFCM140U.i386.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\win32\_socket.pdb source: _socket.pyd.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\pythoncom.pdb},# source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1g 21 Apr 2020built on: Fri Jun 12 19:53:43 2020 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source: Binary string: debugger_parent=pdb.Pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\win32ui.pdbP source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\pywintypes.pdb+ source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\win32\_overlapped.pdb source: _overlapped.pyd.0.dr
Source: Binary string: C:\A\6\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source: Binary string: API-MS-Win-Core-LibraryLoader-L1-1-0.pdb3 source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\python37.pdb source: python37.dll.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: libcrypto-1_1.dll.0.dr
Source: Binary string: C:\A\6\b\libssl-1_1.pdb@@ source: libssl-1_1.dll.0.dr
Source: Binary string: API-MS-Win-Core-LibraryLoader-L1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: C:\A\6\b\libssl-1_1.pdb source: libssl-1_1.dll.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\win32uiole.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: f:\binaries.x86ret\bin\i386\mfc140u.i386.pdb.Z& source: mfc140u.dll.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\pywintypes.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: f:\binaries.x86ret\bin\i386\mfc140u.i386.pdb source: install.exe, 00000000.00000002.512361229.00000000027D2000.00000004.00000800.00020000.00000000.sdmp, mfc140u.dll.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\pythoncom.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\win32uiole.pdb,&" source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\win32ui.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_0040689A FindFirstFileW,FindClose, 0_2_0040689A
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C4E
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_00402902 FindFirstFileW, 0_2_00402902
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\ Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\ Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\_distutils_hack\ Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\_distutils_hack Jump to behavior

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2012811 ET DNS Query to a .tk domain - Likely Hostile 192.168.2.3:62724 -> 8.8.8.8:53
Yara detected Generic Downloader
Source: Yara match File source: 0.2.install.exe.2985f11.2.raw.unpack, type: UNPACKEDPE
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://.../back.jpeg
Source: tcl86t.dll.0.dr String found in binary or memory: http://aia.startssl.com/certs/ca.crt0
Source: tcl86t.dll.0.dr String found in binary or memory: http://aia.startssl.com/certs/sca.code3.crt06
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aka.ms/vcpython27
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bit.ly/2hrImnY
Source: contextlib2.py.0.dr String found in binary or memory: http://bugs.python.org/issue12029
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugs.python.org/issue12885)
Source: contextlib2.py.0.dr String found in binary or memory: http://bugs.python.org/issue13585
Source: contextlib2.py.0.dr String found in binary or memory: http://bugs.python.org/issue19404
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugs.python.org/issue7776:
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugs.python.org/issue7833
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: tcl86t.dll.0.dr String found in binary or memory: http://crl.startssl.com/sca-code3.crl0#
Source: tcl86t.dll.0.dr String found in binary or memory: http://crl.startssl.com/sfsca.crl0f
Source: libssl-1_1.dll.0.dr, tcl86t.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://domain.tld/path/to/resource
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://host.name
Source: install.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: tcl86t.dll.0.dr String found in binary or memory: http://ocsp.startssl.com00
Source: tcl86t.dll.0.dr String found in binary or memory: http://ocsp.startssl.com07
Source: libssl-1_1.dll.0.dr, tcl86t.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://ocsp.thawte.com0
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pages.cpsc.ucalgary.ca/~saul/vb_examples/tutorial12/
Source: python37.dll.0.dr String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sources.redhat.com/ml/cygwin/2000-06/msg01274.html
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/19622133/
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://starship.python.net/crew/kernr/mingw32/Notes.html
Source: libssl-1_1.dll.0.dr, tcl86t.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: libssl-1_1.dll.0.dr, tcl86t.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: libssl-1_1.dll.0.dr, tcl86t.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/
Source: distro.py.0.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: distro.py.0.dr String found in binary or memory: http://www.freedesktop.org/software/systemd/man/os-release.html
Source: chardistribution.py.0.dr, chardistribution.py0.0.dr String found in binary or memory: http://www.mozilla.org/projects/intl/UniversalCharsetDetection.html
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.python.org
Source: install.exe, 00000000.00000002.512018798.000000000040C000.00000004.00000001.01000000.00000003.sdmp, install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.scintilla.org)
Source: tcl86t.dll.0.dr String found in binary or memory: http://www.startssl.com/0P
Source: tcl86t.dll.0.dr String found in binary or memory: http://www.startssl.com/policy0
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://../package_name-0.1.2.tar.gz
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://../package_name-0.1.2.tar.gz?tokena=A&tokenb=B
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.github.com/user
Source: distro.py.0.dr String found in binary or memory: https://bugs.python.org/issue1322
Source: compat.py1.0.dr String found in binary or memory: https://bugs.python.org/issue14768
Source: logging.py.0.dr String found in binary or memory: https://bugs.python.org/issue19612
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bugs.python.org/issue20164
Source: logging.py.0.dr String found in binary or memory: https://bugs.python.org/issue30418
Source: pyparsing.py.0.dr String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: pyparsing.py.0.dr String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: pyparsing.py.0.dr String found in binary or memory: https://docs.python.org/3/library/re.html
Source: pyparsing.py.0.dr String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mhammond/pywin32
Source: distro.py.0.dr String found in binary or memory: https://github.com/nir0s/distro/issues/162
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/graphs/contributors)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/issues/1084
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/issues/1846
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/issues/3490
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/issues/3578.
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/network/dependents?package_id=UGFja2FnZS01NzA4OTExNg%3D%3D)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/psf/requests/pull/2238
Source: spinners.py.0.dr String found in binary or memory: https://github.com/pypa/pip/issues/3418
Source: install.py0.0.dr String found in binary or memory: https://github.com/pypa/pip/issues/new
Source: prepare.py.0.dr String found in binary or memory: https://github.com/pypa/pip/pull/6770
Source: compat.py1.0.dr String found in binary or memory: https://github.com/pypa/pip/pull/935#discussion_r5307003
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: pyparsing.py.0.dr String found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: logging.py.0.dr String found in binary or memory: https://github.com/python/mypy/issues/1297
Source: logging.py.0.dr String found in binary or memory: https://github.com/python/mypy/issues/3500
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/get
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/post
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/github/contributors/psf/requests.svg)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://img.shields.io/pypi/pyversions/requests.svg)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://kennethreitz.org)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pepy.tech/badge/requests/month)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pepy.tech/project/requests/month)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pypi.org/project/requests)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pypi.org/simple/
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/psf/requests/master/ext/kr.png)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/psf/requests/master/ext/psf.png)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/psf/requests/master/ext/ss.png)
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://requests.readthedocs.io
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://requests.readthedocs.io)
Source: pyparsing.py.0.dr String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/questions/45138084/pythonwin-occasionally-gives-an-error-on-opening
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc6125#section-6.4.3
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-6.4.4
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://upload.pypi.org/legacy/
Source: cacert.pem0.0.dr String found in binary or memory: https://www.catcert.net/verarrel
Source: libssl-1_1.dll.0.dr, _overlapped.pyd.0.dr, libcrypto-1_1.dll.0.dr, _socket.pyd.0.dr, python37.dll.0.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ietf.org/rfc/rfc4627.txt
Source: libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr String found in binary or memory: https://www.openssl.org/H
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.python.org
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/psf)
Source: unknown DNS traffic detected: queries for: google.com
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_004056E3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004056E3
Uses 32bit PE files
Source: install.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
PE file does not import any functions
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: python3.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMFC140U.DLL^ vs install.exe
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMFCM140U.DLL^ vs install.exe
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameScintilla.DLL4 vs install.exe
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32ui.pyd0 vs install.exe
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewin32uiole.pyd0 vs install.exe
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepythoncom37.dll0 vs install.exe
Source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepywintypes37.dll0 vs install.exe
PE file contains strange resources
Source: install.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: install.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: install.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mfc140u.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: python.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: python.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pythonw.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pythonw.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tk86t.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tk86t.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tk86t.dll.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004035D8
Detected potential crypto function
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_00406C5B 0_2_00406C5B
Source: install.exe Virustotal: Detection: 34%
Source: install.exe ReversingLabs: Detection: 54%
Source: C:\Users\user\Desktop\install.exe File read: C:\Users\user\Desktop\install.exe Jump to behavior
Source: install.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\install.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\install.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004035D8
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Users\user\AppData\Local\Temp\nsa5DBC.tmp Jump to behavior
Source: classification engine Classification label: mal76.troj.winEXE@1/382@4/0
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_004021A2 CoCreateInstance, 0_2_004021A2
Source: C:\Users\user\Desktop\install.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_00404983 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404983
Source: install.exe Static file information: File size 18595672 > 1048576
Source: install.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: MFCM140U.i386.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\win32\_socket.pdb source: _socket.pyd.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\pythoncom.pdb},# source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1g 21 Apr 2020built on: Fri Jun 12 19:53:43 2020 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source: Binary string: debugger_parent=pdb.Pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\win32ui.pdbP source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\pywintypes.pdb+ source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\win32\_overlapped.pdb source: _overlapped.pyd.0.dr
Source: Binary string: C:\A\6\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source: Binary string: API-MS-Win-Core-LibraryLoader-L1-1-0.pdb3 source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\python37.pdb source: python37.dll.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: libcrypto-1_1.dll.0.dr
Source: Binary string: C:\A\6\b\libssl-1_1.pdb@@ source: libssl-1_1.dll.0.dr
Source: Binary string: API-MS-Win-Core-LibraryLoader-L1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: C:\A\6\b\libssl-1_1.pdb source: libssl-1_1.dll.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\win32uiole.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: f:\binaries.x86ret\bin\i386\mfc140u.i386.pdb.Z& source: mfc140u.dll.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\pywintypes.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: f:\binaries.x86ret\bin\i386\mfc140u.i386.pdb source: install.exe, 00000000.00000002.512361229.00000000027D2000.00000004.00000800.00020000.00000000.sdmp, mfc140u.dll.0.dr
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\pythoncom.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\win32uiole.pdb,&" source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win32-3.7\Release\win32ui.pdb source: install.exe, 00000000.00000002.512794788.000000000292B000.00000004.00000800.00020000.00000000.sdmp
PE file contains sections with non-standard names
Source: libcrypto-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: vcruntime140.dll.0.dr Static PE information: section name: _RDATA
Drops PE files
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\isapi\PyISAPI_loader.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\python.exe Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\winsound.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\python37.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_msi.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\pythonw.exe Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\tk86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\tcl86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\LICENSE.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\adodbapi\license.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\adodbapi\readme.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\isapi\README.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\isapi\samples\README.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe File created: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\isapi\test\README.txt Jump to behavior
Source: C:\Users\user\Desktop\install.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\isapi\PyISAPI_loader.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\python.exe Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_asyncio.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\winsound.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\pyexpat.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_multiprocessing.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_overlapped.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\sqlite3.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_elementtree.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\python37.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_msi.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\pythonw.exe Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_sqlite3.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\tk86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\tcl86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\_ctypes.pyd Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Dropped PE file which has not been started: C:\Program Files (x86)\WinSoft Update Service\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_0040689A FindFirstFileW,FindClose, 0_2_0040689A
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C4E
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_00402902 FindFirstFileW, 0_2_00402902
Source: C:\Users\user\Desktop\install.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\install.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\ Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\ Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\_distutils_hack\ Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib Jump to behavior
Source: C:\Users\user\Desktop\install.exe File opened: C:\Program Files (x86)\WinSoft Update Service\Lib\site-packages\_distutils_hack Jump to behavior
Source: cacert.pem0.0.dr Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: C:\Users\user\Desktop\install.exe Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004035D8
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 652527 Sample: install.exe Startdate: 26/06/2022 Architecture: WINDOWS Score: 76 17 wjecpujpanmwm.tk 2->17 19 studiofotografico35mm.altervista.org 2->19 21 2 other IPs or domains 2->21 23 Snort IDS alert for network traffic 2->23 25 Multi AV Scanner detection for domain / URL 2->25 27 Antivirus / Scanner detection for submitted sample 2->27 29 2 other signatures 2->29 6 install.exe 447 2->6         started        signatures3 process4 file5 9 C:\Program Files (x86)\...\winsound.pyd, PE32 6->9 dropped 11 C:\Program Files (x86)\...\vcruntime140.dll, PE32 6->11 dropped 13 C:\Program Files (x86)\...\unicodedata.pyd, PE32 6->13 dropped 15 314 other files (none is malicious) 6->15 dropped
⊘No contacted IP infos

Contacted Domains

Name IP Active
wjecpujpanmwm.tk 104.21.32.150 true
google.com 172.217.16.206 true
lucaespo.altervista.org unknown unknown
studiofotografico35mm.altervista.org unknown unknown