Windows Analysis Report
lApMYpXACB.exe

Overview

General Information

Sample name:	lApMYpXACB.exe renamed because original name is a hash value
Original sample name:	cf8a0e1dd37a644849a2a0fd44edfb76dd1bdf822f3fdd6cdfa75d8aeb2c6bef.exe
Analysis ID:	1501759
MD5:	5eaf0bdcca1e8ef9a1790cb2fd5f8d5c
SHA1:	c3776dc694835a245735da3a9a4ad045172230dc
SHA256:	cf8a0e1dd37a644849a2a0fd44edfb76dd1bdf822f3fdd6cdfa75d8aeb2c6bef
Tags:	120-46-149-112exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

One or more processes crash

Sigma detected: Communication To Uncommon Destination Ports

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: lApMYpXACB.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: lApMYpXACB.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: E:\Project\dy_load\x64\Release\dy_load.pdb source: lApMYpXACB.exe

Networking

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49701 -> 8888

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.11:49701 -> 120.46.149.112:8888

Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112

Source: C:\Users\user\Desktop\lApMYpXACB.exe

Code function: 0_2_00007FF6D4DB1000 InternetOpenW,InternetOpenUrlA,InternetReadFile,GetModuleHandleW,GetProcAddress,VirtualProtect,

0_2_00007FF6D4DB1000

Source: global traffic

HTTP traffic detected: GET /safekey HTTP/1.1User-Agent: myappHost: 120.46.149.112:8888Cache-Control: no-cache

Source: lApMYpXACB.exe, 00000000.00000002.1724475143.0000019AC8C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112/
Source: lApMYpXACB.exe, 00000000.00000002.1724310824.00000025805FA000.00000004.00000010.00020000.00000000.sdmp, lApMYpXACB.exe, 00000000.00000002.1724475143.0000019AC8C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey
Source: lApMYpXACB.exe, 00000000.00000002.1724475143.0000019AC8C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey?
Source: lApMYpXACB.exe, 00000000.00000002.1724475143.0000019AC8C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyc
Source: lApMYpXACB.exe, 00000000.00000002.1724475143.0000019AC8C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeye1
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net

One or more processes crash

Source: C:\Users\user\Desktop\lApMYpXACB.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4476 -s 1120

Source: classification engine

Classification label: mal56.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4476

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\33b203cb-cdf0-409a-9172-6e1b107c32e3

Jump to behavior

Source: lApMYpXACB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lApMYpXACB.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: lApMYpXACB.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\lApMYpXACB.exe "C:\Users\user\Desktop\lApMYpXACB.exe"
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4476 -s 1120

Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\lApMYpXACB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: lApMYpXACB.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: lApMYpXACB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lApMYpXACB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lApMYpXACB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lApMYpXACB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lApMYpXACB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lApMYpXACB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: lApMYpXACB.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: lApMYpXACB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: E:\Project\dy_load\x64\Release\dy_load.pdb source: lApMYpXACB.exe

Source: lApMYpXACB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lApMYpXACB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lApMYpXACB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lApMYpXACB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lApMYpXACB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49701 -> 8888

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: lApMYpXACB.exe, 00000000.00000002.1724475143.0000019AC8C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: lApMYpXACB.exe, 00000000.00000002.1724475143.0000019AC8CA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\lApMYpXACB.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\lApMYpXACB.exe

Code function: 0_2_00007FF6D4DB1918 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6D4DB1918

Source: C:\Users\user\Desktop\lApMYpXACB.exe	Code function: 0_2_00007FF6D4DB1424 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6D4DB1424
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Code function: 0_2_00007FF6D4DB1918 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6D4DB1918
Source: C:\Users\user\Desktop\lApMYpXACB.exe	Code function: 0_2_00007FF6D4DB1AC0 SetUnhandledExceptionFilter,	0_2_00007FF6D4DB1AC0

Source: C:\Users\user\Desktop\lApMYpXACB.exe

Code function: 0_2_00007FF6D4DB17F0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6D4DB17F0

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
120.46.149.112	unknown	China		4847	CNIX-APChinaNetworksInter-ExchangeCN	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://120.46.149.112:8888/safekey	false	Avira URL Cloud: safe	unknown

ID:	1501759
Product:	CloudBasic
Start time:	12:42:24
Start date:	30.08.2024
Sample:	lApMYpXACB.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	5eaf0bdcca1e8ef9a1790cb2fd5f8d5c
SHA1:	c3776dc694835a245735da3a9a4ad045172230dc
SHA256:	cf8a0e1dd37a644849a2a0fd44edfb76dd1bdf822f3fdd6cdfa75d8aeb2c6bef
Filetype:	Win64 Executable GUI (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lApMYpXACB.exe_3b254f2d213ebcfb26dee9e62fecff4317ef7935_d79dcfe3_5c24a137-c0ad-436c-8948-e234cd864edf\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1C2463C49E3053ED85C93E00E33F3964	D2FEBE73DA0C3131B03E158507CED8F1832DA92D	73970F1EA79F742DE6CBE98BA28D9008FBF54D3DB868257F1FA55A22189C5233
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA324.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Aug 30 10:43:44 2024, 0x1205a4 type	F19CD13C173DFA72EDBD6A9CD1F612F7	B103ADEB5C32B7E17A9C0B9FB18E8B6CF27B49E3	B2197A762EE06584426D17AAE1C97AD3F48D86854BDDCDEC22142081FD62769C
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3C1.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	811A2E396B7F1C6CA96832231965D8F8	0BE021B13AD21CBB5F9325F5BBC5831DC7FB8FC4	367320731B4CAC655F7B964EC1188AE234906AFE93B9F3222CCCA090E0D74F71
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA400.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	D6B9DC7ABB9E684DF8DECBD2B2503917	CD3AEB8AA5A59683E6738DC0AB5EFA26D18E229C	F7F660EDBBB9C59BA7AFC6E6690BC7D03C2F0A2B551253FD8C016751A6A5B411
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	7B1AC5367098F6A0928BEF92B0B0D25B	D4759A0035CDD61B89E1258F80BB32A864221FBD	74B179D361418EB387A8A9DCB0894F25C911200C63ACC6FD37DA45EC5A3B8EF1

Windows Analysis Report
lApMYpXACB.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report lApMYpXACB.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
lApMYpXACB.exe