Windows Analysis Report
HS0ELYUCh9.exe

Overview

General Information

Sample name:	HS0ELYUCh9.exe renamed because original name is a hash value
Original sample name:	adb0ab9c1aee963863e5c93bb22eb0f7c53804e1424b7d7ca277940dd0b75722.exe
Analysis ID:	1530949
MD5:	bf8a06edd620a210421a8443626803d1
SHA1:	6d30ee1be20b40add15db916c9fc998796237f37
SHA256:	adb0ab9c1aee963863e5c93bb22eb0f7c53804e1424b7d7ca277940dd0b75722
Tags:	185-235-241-208exeuser-JAMESWT_MHT
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

One or more processes crash

PE file does not import any functions

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: HS0ELYUCh9.exe

ReversingLabs: Detection: 20%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Uses 32bit PE files

Source: HS0ELYUCh9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: HS0ELYUCh9.exe	String found in binary or memory: Run, %exe% "https://www.youtube.com/watch?v=5Da2qVntopk" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: Send, www.linkedin.com/in/JosiahsScott equals www.linkedin.com (Linkedin)
Source: HS0ELYUCh9.exe	String found in binary or memory: run https://www.youtube.com/results?search_query=connect+PEX+to+toilet equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = "https://www.youtube.com/watch?v=5Da2qVntopk" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = "https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = -url="https://www.youtube.com/watch?v=5Da2qVntopk" -url="https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = url="https://www.youtube.com/watch?v=5Da2qVntopk" url="https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)

Source: HS0ELYUCh9.exe	String found in binary or memory: http://192.168.1.1
Source: HS0ELYUCh9.exe	String found in binary or memory: http://turtlecreekstore.weebly.com/
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.efficiencyhelp.com/ra/
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.godwingreenroofs.com
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/64/favicon-red.ico
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/64/favicon.ico
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/BibleStudies/John-Jacobs-Power-Force.htm
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/mPRL
Source: HS0ELYUCh9.exe	String found in binary or memory: https://alfred.camera/webapp/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://autohotkey.com/logos/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://craigslist.org/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://d.docs.live.net/8dc2922513253ddd/Phone-Doc-Sync/Ph2PC.rtf
Source: HS0ELYUCh9.exe	String found in binary or memory: https://gainesville.craigslist.org/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://hello.freeconference.com/conf/call/2540897
Source: HS0ELYUCh9.exe	String found in binary or memory: https://talk2righteous.ryver.com/index.html#forums/1094233
Source: HS0ELYUCh9.exe	String found in binary or memory: https://theconversation.com/us/technology
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/history/Scripts/Josiahs-Master-Script.ahk?_subject_uid=233633894&undelete=1
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/s/1rz25xk5ta1de01/Songs-of-the-Righteous.doc?dl=00
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/sh/t50csfyj0kcqm9o/AACYbjZ5mPJBQETIuF7DeZVma?dl=0
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.virustotal.com/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/results?search_query=connect
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/watch?v=5Da2qVntopk
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/watch?v=sgC3JqQcT-8
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www2.deloitte.com/insights/us/en/focus/tech-trends/2018/no-collar-workforce.html

One or more processes crash

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 196

PE file does not import any functions

Source: HS0ELYUCh9.exe

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: HS0ELYUCh9.exe, 00000000.00000000.1651070965.00000000005CB000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs HS0ELYUCh9.exe
Source: HS0ELYUCh9.exe	Binary or memory string: OriginalFilename vs HS0ELYUCh9.exe

Uses 32bit PE files

Source: HS0ELYUCh9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@3/9@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6632

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4cdbca0a-ae8b-4139-b2b3-4dfb34e0763e

Jump to behavior

Source: HS0ELYUCh9.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HS0ELYUCh9.exe

ReversingLabs: Detection: 20%

Source: HS0ELYUCh9.exe	String found in binary or memory: <!--StartFragment-->
Source: HS0ELYUCh9.exe	String found in binary or memory: GoSub, GUI-Start
Source: HS0ELYUCh9.exe	String found in binary or memory: Gui, Add, Picture, w220 h100 x450 y190 gGet-Help, %EHEFolder%\Get-Help.gif
Source: HS0ELYUCh9.exe	String found in binary or memory: Get-Help:
Source: HS0ELYUCh9.exe	String found in binary or memory: Gui, Add, Button, gGet-Help-OK, OK
Source: HS0ELYUCh9.exe	String found in binary or memory: Get-Help-OK:
Source: HS0ELYUCh9.exe	String found in binary or memory: Length := EndNum-StartNum+SizeOfSE
Source: HS0ELYUCh9.exe	String found in binary or memory: Run, "C:\Files\ComputerOperation\Scripts\Favicons-ico-Tray-Icons-Shell32--add-1-number-to-get-right-picture.png"
Source: HS0ELYUCh9.exe	String found in binary or memory: MINIMIZE-StartUp-App:
Source: HS0ELYUCh9.exe	String found in binary or memory: EXPAND-StartUp-App:
Source: HS0ELYUCh9.exe	String found in binary or memory: EXPAND-StartUp-App
Source: HS0ELYUCh9.exe	String found in binary or memory: MINIMIZE-StartUp-App
Source: HS0ELYUCh9.exe	String found in binary or memory: start_fragment := InStr(data, "<!--StartFragment-->") + 20
Source: HS0ELYUCh9.exe	String found in binary or memory: label_03 =Paragraphs-Tabs--Add
Source: HS0ELYUCh9.exe	String found in binary or memory: label_04 =Paragraphs-4-Spaces--Add
Source: HS0ELYUCh9.exe	String found in binary or memory: Paragraphs-Tabs--Add:
Source: HS0ELYUCh9.exe	String found in binary or memory: Paragraphs-4-Spaces--Add:
Source: HS0ELYUCh9.exe	String found in binary or memory: ClipX--Install:
Source: HS0ELYUCh9.exe	String found in binary or memory: GoTo, URL-App--Start
Source: HS0ELYUCh9.exe	String found in binary or memory: GoSub, URL-App--Start
Source: HS0ELYUCh9.exe	String found in binary or memory: URL-App--Start:

Source: unknown	Process created: C:\Users\user\Desktop\HS0ELYUCh9.exe "C:\Users\user\Desktop\HS0ELYUCh9.exe"
Source: C:\Users\user\Desktop\HS0ELYUCh9.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 196
Source: C:\Users\user\Desktop\HS0ELYUCh9.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 200

Source: HS0ELYUCh9.exe

Static file information: File size 1882624 > 1048576

Source: HS0ELYUCh9.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x104a00

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Process queried: DebugPort

Jump to behavior

Source: HS0ELYUCh9.exe

Binary or memory string: WinGetPos,,, desk_width, desk_height, Program Manager

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HS0ELYUCh9.exe_1acf131be8f1b0612fdd819233887b5ff46_169523e3_db24732d-3337-4c78-a49f-4a97d241e36d\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	825617895B64B9D6C9E10FCD3995B969	BBB6140B2A3C730903C8BC48682E186D1AC5F03C	3D0CF4339BECB5059555DCF7732ACFA523C5F79DE40DB3C3B9252B6781995F2A
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HS0ELYUCh9.exe_9f11afaa81eda390684d3f6b288aaf93f25d3d1_169523e3_c7d0e0d5-f201-42c2-ab50-ad248b7153f6\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A5F33ACFFCEEE6AE5410369D6D203CCF	78BBA461CF804EA1F7E8A43BFA5295E5906FD331	F9BE299483E33469C75901613CCD287C04EF199ACCEA7B43672252F826ACF562
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE273.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 10 16:12:00 2024, 0x1205a4 type	1D5E9FC6D63D411EAB48BB953DAE82C8	462B1D043E32E110EFED682F3666CC777EF963A5	7F83945A3D48C6CD000A2AC1745595ABC11C0E020D0B13BE920F1B4BA4505088
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2A3.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	2F36C9B3EC9584B23D1AF0411594D35A	8E74034D075B6906BACDD3B41CB65EFEB648407D	3C2589F12765B75FA7113AF1898D7CC680856B7742C450BD5F90019983638972
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C3.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	6A902D3950A09A9DBEB078F047EBC6AE	4E4398699B2CF746D82DCCBA215E3522ABED58A3	8C88130CCE0DBBEF1F6FADD9EACE6C38FCC2665E3DDEBAF94306F9FD3FE4903E
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE438.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 10 16:12:01 2024, 0x1205a4 type	D53B280758F8D59A80E1A682FEC12CBD	3F458ED059606CE296188AE8C9C8F1710D42A25B	798F91859604E3AF1E20C586CB520BCB02516B3EA0A9BAB26EFF41E9197A49B4
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE487.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	F035924F5AD7D90BFA0748701CEC45D9	095B2A829E07C2E6C06D1D11B1A3657AFDE864BA	8A6720033CB572EBBF5B63F3DCA05D1333DF49795FFB66E06B5E87A2E57B2BD9
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4B7.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	BF7EF7697FC1129730209A650465AF69	B705BA684ABB7F768D0BDA7204561FCDB709951D	9FADC91F88BC2CF60669F60A896B2AC38F2A64D88483A3700E2DA2243CF63253
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	17D0A3720D073299F8B4B9F23119BDAD	AB3ED96EA5388A11DAD61AD73FB8C430E0E4A092	96DE1C050D9E5AEA3DB128DD86AEF34227BC346176D513E994E26E575DDB431A

AV Detection

Multi AV Scanner detection for submitted file

Source: HS0ELYUCh9.exe

ReversingLabs: Detection: 20%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Uses 32bit PE files

Source: HS0ELYUCh9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: HS0ELYUCh9.exe	String found in binary or memory: Run, %exe% "https://www.youtube.com/watch?v=5Da2qVntopk" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: Send, www.linkedin.com/in/JosiahsScott equals www.linkedin.com (Linkedin)
Source: HS0ELYUCh9.exe	String found in binary or memory: run https://www.youtube.com/results?search_query=connect+PEX+to+toilet equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = "https://www.youtube.com/watch?v=5Da2qVntopk" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = "https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = -url="https://www.youtube.com/watch?v=5Da2qVntopk" -url="https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = url="https://www.youtube.com/watch?v=5Da2qVntopk" url="https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)

Source: HS0ELYUCh9.exe	String found in binary or memory: http://192.168.1.1
Source: HS0ELYUCh9.exe	String found in binary or memory: http://turtlecreekstore.weebly.com/
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.efficiencyhelp.com/ra/
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.godwingreenroofs.com
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/64/favicon-red.ico
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/64/favicon.ico
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/BibleStudies/John-Jacobs-Power-Force.htm
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/mPRL
Source: HS0ELYUCh9.exe	String found in binary or memory: https://alfred.camera/webapp/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://autohotkey.com/logos/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://craigslist.org/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://d.docs.live.net/8dc2922513253ddd/Phone-Doc-Sync/Ph2PC.rtf
Source: HS0ELYUCh9.exe	String found in binary or memory: https://gainesville.craigslist.org/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://hello.freeconference.com/conf/call/2540897
Source: HS0ELYUCh9.exe	String found in binary or memory: https://talk2righteous.ryver.com/index.html#forums/1094233
Source: HS0ELYUCh9.exe	String found in binary or memory: https://theconversation.com/us/technology
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/history/Scripts/Josiahs-Master-Script.ahk?_subject_uid=233633894&undelete=1
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/s/1rz25xk5ta1de01/Songs-of-the-Righteous.doc?dl=00
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/sh/t50csfyj0kcqm9o/AACYbjZ5mPJBQETIuF7DeZVma?dl=0
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.virustotal.com/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/results?search_query=connect
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/watch?v=5Da2qVntopk
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/watch?v=sgC3JqQcT-8
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www2.deloitte.com/insights/us/en/focus/tech-trends/2018/no-collar-workforce.html

One or more processes crash

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 196

PE file does not import any functions

Source: HS0ELYUCh9.exe

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: HS0ELYUCh9.exe, 00000000.00000000.1651070965.00000000005CB000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs HS0ELYUCh9.exe
Source: HS0ELYUCh9.exe	Binary or memory string: OriginalFilename vs HS0ELYUCh9.exe

Uses 32bit PE files

Source: HS0ELYUCh9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@3/9@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6632

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4cdbca0a-ae8b-4139-b2b3-4dfb34e0763e

Jump to behavior

Source: HS0ELYUCh9.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HS0ELYUCh9.exe

ReversingLabs: Detection: 20%

Source: HS0ELYUCh9.exe	String found in binary or memory: <!--StartFragment-->
Source: HS0ELYUCh9.exe	String found in binary or memory: GoSub, GUI-Start
Source: HS0ELYUCh9.exe	String found in binary or memory: Gui, Add, Picture, w220 h100 x450 y190 gGet-Help, %EHEFolder%\Get-Help.gif
Source: HS0ELYUCh9.exe	String found in binary or memory: Get-Help:
Source: HS0ELYUCh9.exe	String found in binary or memory: Gui, Add, Button, gGet-Help-OK, OK
Source: HS0ELYUCh9.exe	String found in binary or memory: Get-Help-OK:
Source: HS0ELYUCh9.exe	String found in binary or memory: Length := EndNum-StartNum+SizeOfSE
Source: HS0ELYUCh9.exe	String found in binary or memory: Run, "C:\Files\ComputerOperation\Scripts\Favicons-ico-Tray-Icons-Shell32--add-1-number-to-get-right-picture.png"
Source: HS0ELYUCh9.exe	String found in binary or memory: MINIMIZE-StartUp-App:
Source: HS0ELYUCh9.exe	String found in binary or memory: EXPAND-StartUp-App:
Source: HS0ELYUCh9.exe	String found in binary or memory: EXPAND-StartUp-App
Source: HS0ELYUCh9.exe	String found in binary or memory: MINIMIZE-StartUp-App
Source: HS0ELYUCh9.exe	String found in binary or memory: start_fragment := InStr(data, "<!--StartFragment-->") + 20
Source: HS0ELYUCh9.exe	String found in binary or memory: label_03 =Paragraphs-Tabs--Add
Source: HS0ELYUCh9.exe	String found in binary or memory: label_04 =Paragraphs-4-Spaces--Add
Source: HS0ELYUCh9.exe	String found in binary or memory: Paragraphs-Tabs--Add:
Source: HS0ELYUCh9.exe	String found in binary or memory: Paragraphs-4-Spaces--Add:
Source: HS0ELYUCh9.exe	String found in binary or memory: ClipX--Install:
Source: HS0ELYUCh9.exe	String found in binary or memory: GoTo, URL-App--Start
Source: HS0ELYUCh9.exe	String found in binary or memory: GoSub, URL-App--Start
Source: HS0ELYUCh9.exe	String found in binary or memory: URL-App--Start:

Source: unknown	Process created: C:\Users\user\Desktop\HS0ELYUCh9.exe "C:\Users\user\Desktop\HS0ELYUCh9.exe"
Source: C:\Users\user\Desktop\HS0ELYUCh9.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 196
Source: C:\Users\user\Desktop\HS0ELYUCh9.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 200

Source: HS0ELYUCh9.exe

Static file information: File size 1882624 > 1048576

Source: HS0ELYUCh9.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x104a00

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Process queried: DebugPort

Jump to behavior

Source: HS0ELYUCh9.exe

Binary or memory string: WinGetPos,,, desk_width, desk_height, Program Manager

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

ID:	1530949
Product:	CloudBasic
Start time:	18:11:06
Start date:	10.10.2024
Sample:	HS0ELYUCh9.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	bf8a06edd620a210421a8443626803d1
SHA1:	6d30ee1be20b40add15db916c9fc998796237f37
SHA256:	adb0ab9c1aee963863e5c93bb22eb0f7c53804e1424b7d7ca277940dd0b75722
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Windows Analysis Report
HS0ELYUCh9.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report HS0ELYUCh9.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
HS0ELYUCh9.exe