Edit tour

Windows Analysis Report
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
Analysis ID:	1427216
MD5:	35a00ae36ee03f200bad5a922afacd04
SHA1:	05dd9e5eae8378394d9426fd97e18d2d485db3fa
SHA256:	c99b0aea44483bd5145b0bd811ad6b0fe4b7aa5867a4f12e979fbbea9648ad02
Tags:	exe
Infos:

Detection

Score:	30
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Antivirus detection for dropped file

Modifies the DNS server

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables driver privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

Modifies existing windows services

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries device information via Setup API

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe (PID: 4544 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe" MD5: 35A00AE36EE03F200BAD5A922AFACD04)

SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp (PID: 2680 cmdline: "C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp" /SL5="$20404,1488690,832512,C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe" MD5: 74F03B0063ABA7C8CC9A8D4FED6B2381)

pvextra.exe (PID: 2912 cmdline: "C:\Program Files (x86)\PairVPN\pvextra.exe" /d MD5: CB12C48A9D14A5018DD07BBB8E71AC9A)

netsh.exe (PID: 5236 cmdline: "netsh.exe" advfirewall firewall add rule name="PairVPN" dir=in action=allow program="C:\Program Files (x86)\PairVPN\PairVPN.exe" enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 5328 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 2852 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.inf" "9" "4ec797a8f" "0000000000000100" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\pairvpn\pveth" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 6440 cmdline: DrvInst.exe "2" "211" "ROOT\PVETH\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:1f6a2eb20729039e:pveth.ndi:1.8.3.0:pveth," "4ec797a8f" "0000000000000100" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

svchost.exe (PID: 2216 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, ProcessId: 5328, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Program Files (x86)\PairVPN\is-GAJBA.tmp

Avira: detection malicious, Label: HEUR/AGEN.1319028

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.BY CONTINUING THIS INSTALLATION YOU AGREE TO BE BOUND BY ALL THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT.SOFTWARE LICENSE AGREEMENTThis Agreement is a license agreement between you and MOBILE COMPANY for the use of the enclosed software (PairVPN). PairVPN is protected by both United States and International copyright law. Therefore you must treat this license and PairVPN just like a book with the following exceptions: you agree pursuant to the license not to rent or lease PairVPN in any form. In addition you may not make any copies of PairVPN except that you may make one archival copy of PairVPN for the sole purpose of backing you your Software and protecting your Investment from loss. This copy must include all copyright notices on PairVPN. By saying "just like a book" MOBILE COMPANY means that PairVPN may be used under the license by any number of people and may be freely moved from one computer location to another so long as there is no possibility of its being used at one location while it is simultaneously used at another. For example just as a book cannot be read by two Different people in two different places at the same time neither can PairVPN be used by used (without violating this agreement) by two different people in two different places at the same time.This license is not a sale. Title and copyrights to PairVPN accompanying Documentation and any copy made by your remain with MOBILE COMPANY. Unauthorized copying of PairVPN or the accompanying Documentation or failure to comply with the above restrictions will result in automatic termination of this license and will make available to MOBILE COMPANY other legal remedies. Upon termination of this license you must return all copies of PairVPN to MOBILE COMPANY and erase any copies from your hard disk.Permitted usesYou may operate PairVPN on a single device provided you do not exceed the quantity of license purchased. Additional device utilizing PairVPN must be licensed by MOBILE COMPANY.Uses not permittedYou may not:Make copies of PairVPN except as permitted in this agreement.Make copies of Related Materials.Alter decompile disassemble or reverse user PairVPN.Remove or alter the MOBILE COMPANY copyright and trademark notices.Remove or alter the icons within PairVPNRent lease sub-license or transfer PairVPN Software copies Related Materials or yourrights under this license without the prior written consent of MOBILE COMPANY.MOBILE COMPANY is not responsible for any charges you may incur from your cellular provider as a result of using PairVPN. MOBILE COMPANY MAKES AND YOU RECEIVE NO WARRANTIES EXPRESS IMPLIED STATUTORY OR IN ANY COMMUNICATION WITH YOU AND MOBILE COMPANY SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.BY CONTINUING THIS INSTALLATION YOU AGREE TO BE BOUND BY ALL THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT.SOFTWARE LICENSE AGREEMENTThis Agreement is a license agreement between you and MOBILE COMPANY for the use of the enclosed software (PairVPN). PairVPN is protected by both United States and International copyright law. Therefore you must treat this license and PairVPN just like a book with the following exceptions: you agree pursuant to the license not to rent or lease PairVPN in any form. In addition you may not make any copies of PairVPN except that you may make one archival copy of PairVPN for the sole purpose of backing you your Software and protecting your Investment from loss. This copy must include all copyright notices on PairVPN. By saying "just like a book" MOBILE COMPANY means that PairVPN may be used under the license by any number of people and may be freely moved from one computer location to another so long as there is no possibility of its being used at one location while it is simultaneously used at another. For example just as a book cannot be read by two Different people in two different places at the same time neither can PairVPN be used by used (without violating this agreement) by two different people in two different places at the same time.This license is not a sale. Title and copyrights to PairVPN accompanying Documentation and any copy made by your remain with MOBILE COMPANY. Unauthorized copying of PairVPN or the accompanying Documentation or failure to comply with the above restrictions will result in automatic termination of this license and will make available to MOBILE COMPANY other legal remedies. Upon termination of this license you must return all copies of PairVPN to MOBILE COMPANY and erase any copies from your hard disk.Permitted usesYou may operate PairVPN on a single device provided you do not exceed the quantity of license purchased. Additional device utilizing PairVPN must be licensed by MOBILE COMPANY.Uses not permittedYou may not:Make copies of PairVPN except as permitted in this agreement.Make copies of Related Materials.Alter decompile disassemble or reverse user PairVPN.Remove or alter the MOBILE COMPANY copyright and trademark notices.Remove or alter the icons within PairVPNRent lease sub-license or transfer PairVPN Software copies Related Materials or yourrights under this license without the prior written consent of MOBILE COMPANY.MOBILE COMPANY is not responsible for any charges you may incur from your cellular provider as a result of using PairVPN. MOBILE COMPANY MAKES AND YOU RECEIVE NO WARRANTIES EXPRESS IMPLIED STATUTORY OR IN ANY COMMUNICATION WITH YOU AND MOBILE COMPANY SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.BY CONTINUING THIS INSTALLATION YOU AGREE TO BE BOUND BY ALL THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT.SOFTWARE LICENSE AGREEMENTThis Agreement is a license agreement between you and MOBILE COMPANY for the use of the enclosed software (PairVPN). PairVPN is protected by both United States and International copyright law. Therefore you must treat this license and PairVPN just like a book with the following exceptions: you agree pursuant to the license not to rent or lease PairVPN in any form. In addition you may not make any copies of PairVPN except that you may make one archival copy of PairVPN for the sole purpose of backing you your Software and protecting your Investment from loss. This copy must include all copyright notices on PairVPN. By saying "just like a book" MOBILE COMPANY means that PairVPN may be used under the license by any number of people and may be freely moved from one computer location to another so long as there is no possibility of its being used at one location while it is simultaneously used at another. For example just as a book cannot be read by two Different people in two different places at the same time neither can PairVPN be used by used (without violating this agreement) by two different people in two different places at the same time.This license is not a sale. Title and copyrights to PairVPN accompanying Documentation and any copy made by your remain with MOBILE COMPANY. Unauthorized copying of PairVPN or the accompanying Documentation or failure to comply with the above restrictions will result in automatic termination of this license and will make available to MOBILE COMPANY other legal remedies. Upon termination of this license you must return all copies of PairVPN to MOBILE COMPANY and erase any copies from your hard disk.Permitted usesYou may operate PairVPN on a single device provided you do not exceed the quantity of license purchased. Additional device utilizing PairVPN must be licensed by MOBILE COMPANY.Uses not permittedYou may not:Make copies of PairVPN except as permitted in this agreement.Make copies of Related Materials.Alter decompile disassemble or reverse user PairVPN.Remove or alter the MOBILE COMPANY copyright and trademark notices.Remove or alter the icons within PairVPNRent lease sub-license or transfer PairVPN Software copies Related Materials or yourrights under this license without the prior written consent of MOBILE COMPANY.MOBILE COMPANY is not responsible for any charges you may incur from your cellular provider as a result of using PairVPN. MOBILE COMPANY MAKES AND YOU RECEIVE NO WARRANTIES EXPRESS IMPLIED STATUTORY OR IN ANY COMMUNICATION WITH YOU AND MOBILE COMPANY SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Static PE information: certificate valid

Source: unknown

HTTPS traffic detected: 45.33.111.235:443 -> 192.168.2.6:49717 version: TLS 1.2

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\vmware\AllPairVPNGit\Windows\pvextra\x64\Release\pvextra.pdb source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, pvextra.exe, 00000003.00000000.2189765772.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, pvextra.exe, 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, is-GAJBA.tmp.2.dr
Source:	Binary string: NetSetupuser.pdb source: service.0.etl.8.dr
Source:	Binary string: NetSetupSvc.pdb source: service.0.etl.8.dr
Source:	Binary string: NetSetupApi.pdb source: service.0.etl.8.dr
Source:	Binary string: C:\vmware\AllPairVPNGit\Windows\pvservice\x64\Release\pvservice.pdb"" source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000002.2367358119.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-A2FHO.tmp.2.dr
Source:	Binary string: C:\vmware\AllPairVPNGit\Windows\PairVPN2_Windows\Release\PairVPN2.pdb source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr
Source:	Binary string: C:\vmware\AllPairVPNGit\Windows\pvservice\x64\Release\pvservice.pdb source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000002.2367358119.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-A2FHO.tmp.2.dr
Source:	Binary string: Z:\AllPairVPNGit\Windows\pveth\60\x64\Release\pveth.pdb source: pvextra.exe, 00000003.00000003.2258632091.0000024B76E41000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000005.00000003.2201598405.00000201173FA000.00000004.00000020.00020000.00000000.sdmp, SET39E7.tmp.3.dr, SET3B7E.tmp.5.dr, is-UADM2.tmp.2.dr
Source:	Binary string: NetSetupApi.pdbdb source: service.0.etl.8.dr

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Code function: 3_2_00007FF6B0558988 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,

3_2_00007FF6B0558988

Source: global traffic

HTTP traffic detected: GET /dev/install.php?err=t11037 HTTP/1.1Host: pairv.netCache-Control: no-cache

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /dev/install.php?err=t11037 HTTP/1.1Host: pairv.netCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: pairv.net

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: is-2PSH3.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/transfer/Get
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/04/discovery
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/devprof
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, is-2PSH3.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: pvextra.exe, 00000003.00000002.2276030070.0000024B76E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pairv.net/
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, pvextra.exe, pvextra.exe, 00000003.00000000.2189765772.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, pvextra.exe, 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, is-GAJBA.tmp.2.dr	String found in binary or memory: https://pairv.net/dev/install.php?err=t%d
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, pvextra.exe, 00000003.00000000.2189765772.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, pvextra.exe, 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, is-GAJBA.tmp.2.dr	String found in binary or memory: https://pairv.net/dev/install.php?err=t%d/uPairVPN_cls/twintrust.dllCryptCATAdminAcquireContext2
Source: pvextra.exe, 00000003.00000002.2275353729.0000024B75259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pairv.net/dev/install.php?err=t11037
Source: pvextra.exe, 00000003.00000002.2276030070.0000024B76E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pairv.net/dev/install.php?err=t11037:
Source: pvextra.exe, 00000003.00000002.2275353729.0000024B75259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pairv.net/dev/install.php?err=t11037Provider
Source: pvextra.exe, 00000003.00000002.2276030070.0000024B76E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pairv.net/dev/install.php?err=t11037z
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: https://pairvpn.com
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: https://pairvpn.com%s/%ssvr_btn_offsession_pending_review_numsession_pending_review_msgInvalid
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: https://www.google.com/maps/search/?api=1&query=%f%%2C%f
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	String found in binary or memory: https://www.google.com/maps/search/?api=1&query=%f%%2C%fcli_txt_clockInvalid
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071977197.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071570713.0000000002750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000000.2073224935.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp.0.dr, is-7A3OK.tmp.2.dr	String found in binary or memory: https://www.innosetup.com/
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2368668070.00000000024F3000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2366041316.00000000025D3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pairvpn.com
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2070023257.0000000002750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2074992354.0000000003490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pairvpn.com.https://www.pairvpn.com.https://www.pairvpn.com
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2368668070.00000000024F3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pairvpn.comQ6O
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071977197.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071570713.0000000002750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000000.2073224935.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp.0.dr, is-7A3OK.tmp.2.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown

HTTPS traffic detected: 45.33.111.235:443 -> 192.168.2.6:49717 version: TLS 1.2

Source: C:\Program Files (x86)\PairVPN\pvextra.exe	File created: C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	File created: C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39C6.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B5C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\pveth\pveth.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\pveth\is-5S3BL.tmp	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}

Jump to behavior

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\pveth.inf_amd64_4d971e32342dbc12	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf	Jump to behavior

Source: C:\Windows\System32\drvinst.exe

File deleted: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B5C.tmp

Jump to behavior

Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B0551710	3_2_00007FF6B0551710
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B0551060	3_2_00007FF6B0551060
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B055C17C	3_2_00007FF6B055C17C
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B0558988	3_2_00007FF6B0558988
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B055BD50	3_2_00007FF6B055BD50
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B05541E0	3_2_00007FF6B05541E0
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B05559B8	3_2_00007FF6B05559B8
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B055FE48	3_2_00007FF6B055FE48
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B0557708	3_2_00007FF6B0557708
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B055DC5C	3_2_00007FF6B055DC5C

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Jump to behavior

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-7A3OK.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-2PSH3.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=store

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000000.2069736995.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071977197.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2368668070.00000000024B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071570713.0000000002848000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-UADM2.tmp.2.dr

Binary string: \Device\PVETH

Source: classification engine

Classification label: sus30.spyw.evad.winEXE@14/32@1/1

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

File created: C:\Program Files (x86)\PairVPN

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\drvinst.exe	Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2632:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

File created: C:\Users\user\AppData\Local\Temp\is-83J31.tmp

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: pvextra.exe	String found in binary or memory: https://pairv.net/dev/install.php?err=t%d
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Process created: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp "C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp" /SL5="$20404,1488690,832512,C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe"
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process created: C:\Program Files (x86)\PairVPN\pvextra.exe "C:\Program Files (x86)\PairVPN\pvextra.exe" /d
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.inf" "9" "4ec797a8f" "0000000000000100" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\pairvpn\pveth"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\PVETH\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:1f6a2eb20729039e:pveth.ndi:1.8.3.0:pveth," "4ec797a8f" "0000000000000100"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process created: C:\Windows\SysWOW64\netsh.exe "netsh.exe" advfirewall firewall add rule name="PairVPN" dir=in action=allow program="C:\Program Files (x86)\PairVPN\PairVPN.exe" enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Process created: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp "C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp" /SL5="$20404,1488690,832512,C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process created: C:\Program Files (x86)\PairVPN\pvextra.exe "C:\Program Files (x86)\PairVPN\pvextra.exe" /d	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process created: C:\Windows\SysWOW64\netsh.exe "netsh.exe" advfirewall firewall add rule name="PairVPN" dir=in action=allow program="C:\Program Files (x86)\PairVPN\PairVPN.exe" enable=yes	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.inf" "9" "4ec797a8f" "0000000000000100" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\pairvpn\pveth"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\PVETH\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:1f6a2eb20729039e:pveth.ndi:1.8.3.0:pveth," "4ec797a8f" "0000000000000100"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupuser.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Automated click: OK

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.BY CONTINUING THIS INSTALLATION YOU AGREE TO BE BOUND BY ALL THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT.SOFTWARE LICENSE AGREEMENTThis Agreement is a license agreement between you and MOBILE COMPANY for the use of the enclosed software (PairVPN). PairVPN is protected by both United States and International copyright law. Therefore you must treat this license and PairVPN just like a book with the following exceptions: you agree pursuant to the license not to rent or lease PairVPN in any form. In addition you may not make any copies of PairVPN except that you may make one archival copy of PairVPN for the sole purpose of backing you your Software and protecting your Investment from loss. This copy must include all copyright notices on PairVPN. By saying "just like a book" MOBILE COMPANY means that PairVPN may be used under the license by any number of people and may be freely moved from one computer location to another so long as there is no possibility of its being used at one location while it is simultaneously used at another. For example just as a book cannot be read by two Different people in two different places at the same time neither can PairVPN be used by used (without violating this agreement) by two different people in two different places at the same time.This license is not a sale. Title and copyrights to PairVPN accompanying Documentation and any copy made by your remain with MOBILE COMPANY. Unauthorized copying of PairVPN or the accompanying Documentation or failure to comply with the above restrictions will result in automatic termination of this license and will make available to MOBILE COMPANY other legal remedies. Upon termination of this license you must return all copies of PairVPN to MOBILE COMPANY and erase any copies from your hard disk.Permitted usesYou may operate PairVPN on a single device provided you do not exceed the quantity of license purchased. Additional device utilizing PairVPN must be licensed by MOBILE COMPANY.Uses not permittedYou may not:Make copies of PairVPN except as permitted in this agreement.Make copies of Related Materials.Alter decompile disassemble or reverse user PairVPN.Remove or alter the MOBILE COMPANY copyright and trademark notices.Remove or alter the icons within PairVPNRent lease sub-license or transfer PairVPN Software copies Related Materials or yourrights under this license without the prior written consent of MOBILE COMPANY.MOBILE COMPANY is not responsible for any charges you may incur from your cellular provider as a result of using PairVPN. MOBILE COMPANY MAKES AND YOU RECEIVE NO WARRANTIES EXPRESS IMPLIED STATUTORY OR IN ANY COMMUNICATION WITH YOU AND MOBILE COMPANY SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.BY CONTINUING THIS INSTALLATION YOU AGREE TO BE BOUND BY ALL THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT.SOFTWARE LICENSE AGREEMENTThis Agreement is a license agreement between you and MOBILE COMPANY for the use of the enclosed software (PairVPN). PairVPN is protected by both United States and International copyright law. Therefore you must treat this license and PairVPN just like a book with the following exceptions: you agree pursuant to the license not to rent or lease PairVPN in any form. In addition you may not make any copies of PairVPN except that you may make one archival copy of PairVPN for the sole purpose of backing you your Software and protecting your Investment from loss. This copy must include all copyright notices on PairVPN. By saying "just like a book" MOBILE COMPANY means that PairVPN may be used under the license by any number of people and may be freely moved from one computer location to another so long as there is no possibility of its being used at one location while it is simultaneously used at another. For example just as a book cannot be read by two Different people in two different places at the same time neither can PairVPN be used by used (without violating this agreement) by two different people in two different places at the same time.This license is not a sale. Title and copyrights to PairVPN accompanying Documentation and any copy made by your remain with MOBILE COMPANY. Unauthorized copying of PairVPN or the accompanying Documentation or failure to comply with the above restrictions will result in automatic termination of this license and will make available to MOBILE COMPANY other legal remedies. Upon termination of this license you must return all copies of PairVPN to MOBILE COMPANY and erase any copies from your hard disk.Permitted usesYou may operate PairVPN on a single device provided you do not exceed the quantity of license purchased. Additional device utilizing PairVPN must be licensed by MOBILE COMPANY.Uses not permittedYou may not:Make copies of PairVPN except as permitted in this agreement.Make copies of Related Materials.Alter decompile disassemble or reverse user PairVPN.Remove or alter the MOBILE COMPANY copyright and trademark notices.Remove or alter the icons within PairVPNRent lease sub-license or transfer PairVPN Software copies Related Materials or yourrights under this license without the prior written consent of MOBILE COMPANY.MOBILE COMPANY is not responsible for any charges you may incur from your cellular provider as a result of using PairVPN. MOBILE COMPANY MAKES AND YOU RECEIVE NO WARRANTIES EXPRESS IMPLIED STATUTORY OR IN ANY COMMUNICATION WITH YOU AND MOBILE COMPANY SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.BY CONTINUING THIS INSTALLATION YOU AGREE TO BE BOUND BY ALL THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT.SOFTWARE LICENSE AGREEMENTThis Agreement is a license agreement between you and MOBILE COMPANY for the use of the enclosed software (PairVPN). PairVPN is protected by both United States and International copyright law. Therefore you must treat this license and PairVPN just like a book with the following exceptions: you agree pursuant to the license not to rent or lease PairVPN in any form. In addition you may not make any copies of PairVPN except that you may make one archival copy of PairVPN for the sole purpose of backing you your Software and protecting your Investment from loss. This copy must include all copyright notices on PairVPN. By saying "just like a book" MOBILE COMPANY means that PairVPN may be used under the license by any number of people and may be freely moved from one computer location to another so long as there is no possibility of its being used at one location while it is simultaneously used at another. For example just as a book cannot be read by two Different people in two different places at the same time neither can PairVPN be used by used (without violating this agreement) by two different people in two different places at the same time.This license is not a sale. Title and copyrights to PairVPN accompanying Documentation and any copy made by your remain with MOBILE COMPANY. Unauthorized copying of PairVPN or the accompanying Documentation or failure to comply with the above restrictions will result in automatic termination of this license and will make available to MOBILE COMPANY other legal remedies. Upon termination of this license you must return all copies of PairVPN to MOBILE COMPANY and erase any copies from your hard disk.Permitted usesYou may operate PairVPN on a single device provided you do not exceed the quantity of license purchased. Additional device utilizing PairVPN must be licensed by MOBILE COMPANY.Uses not permittedYou may not:Make copies of PairVPN except as permitted in this agreement.Make copies of Related Materials.Alter decompile disassemble or reverse user PairVPN.Remove or alter the MOBILE COMPANY copyright and trademark notices.Remove or alter the icons within PairVPNRent lease sub-license or transfer PairVPN Software copies Related Materials or yourrights under this license without the prior written consent of MOBILE COMPANY.MOBILE COMPANY is not responsible for any charges you may incur from your cellular provider as a result of using PairVPN. MOBILE COMPANY MAKES AND YOU RECEIVE NO WARRANTIES EXPRESS IMPLIED STATUTORY OR IN ANY COMMUNICATION WITH YOU AND MOBILE COMPANY SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Static PE information: certificate valid

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Static file information: File size 2341000 > 1048576

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\vmware\AllPairVPNGit\Windows\pvextra\x64\Release\pvextra.pdb source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, pvextra.exe, 00000003.00000000.2189765772.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, pvextra.exe, 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, is-GAJBA.tmp.2.dr
Source:	Binary string: NetSetupuser.pdb source: service.0.etl.8.dr
Source:	Binary string: NetSetupSvc.pdb source: service.0.etl.8.dr
Source:	Binary string: NetSetupApi.pdb source: service.0.etl.8.dr
Source:	Binary string: C:\vmware\AllPairVPNGit\Windows\pvservice\x64\Release\pvservice.pdb"" source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000002.2367358119.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-A2FHO.tmp.2.dr
Source:	Binary string: C:\vmware\AllPairVPNGit\Windows\PairVPN2_Windows\Release\PairVPN2.pdb source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr
Source:	Binary string: C:\vmware\AllPairVPNGit\Windows\pvservice\x64\Release\pvservice.pdb source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000002.2367358119.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-A2FHO.tmp.2.dr
Source:	Binary string: Z:\AllPairVPNGit\Windows\pveth\60\x64\Release\pveth.pdb source: pvextra.exe, 00000003.00000003.2258632091.0000024B76E41000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000005.00000003.2201598405.00000201173FA000.00000004.00000020.00020000.00000000.sdmp, SET39E7.tmp.3.dr, SET3B7E.tmp.5.dr, is-UADM2.tmp.2.dr
Source:	Binary string: NetSetupApi.pdbdb source: service.0.etl.8.dr

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Code function: 3_2_00007FF6B0551710 lstrcmpiW,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,LoadLibraryW,GetProcAddress,FreeLibrary,GetModuleFileNameW,PathRemoveFileSpecW,InternetOpenA,InternetOpenUrlA,InternetCloseHandle,InternetCloseHandle,lstrcmpiW,FindWindowW,PostMessageW,Sleep,lstrcmpiW,CreateFileW,CloseHandle,

3_2_00007FF6B0551710

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Static PE information: section name: .didata
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp.0.dr	Static PE information: section name: .didata
Source: is-7A3OK.tmp.2.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\unins000.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	File created: C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39E7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\is-7A3OK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\pveth\is-UADM2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	File created: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\pveth\pveth.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\pvextra.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\is-2PSH3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\PairVPN.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\is-A2FHO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Program Files (x86)\PairVPN\is-GAJBA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J5BNJ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	File created: C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B7E.tmp	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.sys (copy)			Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B7E.tmp			Jump to dropped file

Source: C:\Windows\System32\drvinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pveth

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Code function: 3_2_00007FF6B0551290 SetupDiGetClassDevsW,SetupDiEnumDeviceInfo,SetupDiGetDeviceRegistryPropertyW,wcsstr,SetupDiEnumDeviceInfo,SetupDiDestroyDeviceInfoList,CM_Get_DevNode_Status,SetupDiSetSelectedDevice,SetupDiCallClassInstaller,SetupDiDestroyDeviceInfoList,

3_2_00007FF6B0551290

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PairVPN\unins000.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39E7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PairVPN\is-7A3OK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PairVPN\pveth\is-UADM2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PairVPN\pveth\pveth.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PairVPN\is-2PSH3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PairVPN\PairVPN.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PairVPN\is-A2FHO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J5BNJ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B7E.tmp	Jump to dropped file

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Code function: 3_2_00007FF6B0558988 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,

3_2_00007FF6B0558988

Source: setupapi.dev.log.3.dr	Binary or memory string: set: BIOS Vendor: VMware, Inc.
Source: setupapi.dev.log.3.dr	Binary or memory string: sig: Key = vmci.inf
Source: setupapi.dev.log.3.dr	Binary or memory string: dvs: {Driver Setup Import Driver Package: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.178
Source: setupapi.dev.log.3.dr	Binary or memory string: idb: Activating driver package 'vmci.inf_amd64_68ed49469341f563'.
Source: setupapi.dev.log.3.dr	Binary or memory string: cpy: Published 'vmci.inf_amd64_68ed49469341f563\vmci.inf' to 'oem2.inf'.
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: {Add Service: vmci}
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: Created new service 'vmci'.
Source: is-A2FHO.tmp.2.dr	Binary or memory string: C:\vmware\AllPairVPNGit\Windows\pvservice\x64\Release\pvservice.pdb""
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: Display Name = VMware VMCI Bus Driver
Source: setupapi.dev.log.3.dr	Binary or memory string: set: PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3F -> Configured [oem2.inf:PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD,vmci.install.x64.NT] and started (ConfigFlags = 0x00000000).
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: Service Name = vmci
Source: setupapi.dev.log.3.dr	Binary or memory string: set: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000 -> Configured [disk.inf:GenDisk,disk_install.NT] and started (ConfigFlags = 0x00000000).
Source: pvextra.exe, 00000003.00000002.2276030070.0000024B76E40000.00000004.00000020.00020000.00000000.sdmp, pvextra.exe, 00000003.00000002.2276030070.0000024B76E68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setupapi.dev.log.3.dr	Binary or memory string: idb: {Publish Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf} 11:48:39.707
Source: setupapi.dev.log.3.dr	Binary or memory string: idb: Indexed 4 device IDs for 'vmci.inf_amd64_68ed49469341f563'.
Source: setupapi.dev.log.3.dr	Binary or memory string: utl: Driver INF - oem2.inf (C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf)
Source: setupapi.dev.log.3.dr	Binary or memory string: set: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000 -> Configured [cdrom.inf:GenCdRom,cdrom_install] and started (ConfigFlags = 0x00000000).
Source: setupapi.dev.log.3.dr	Binary or memory string: set: System Product Name: VMware20,1
Source: setupapi.dev.log.3.dr	Binary or memory string: sto: {Configure Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf}
Source: is-A2FHO.tmp.2.dr	Binary or memory string: C:\vmware\AllPairVPNGit\Windows\pvservice\x64\Release\pvservice.pdb
Source: setupapi.dev.log.3.dr	Binary or memory string: sto: {Stage Driver Package: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.634
Source: setupapi.dev.log.3.dr	Binary or memory string: sig: Installed catalog 'vmci.cat' as 'oem2.cat'.
Source: is-GAJBA.tmp.2.dr	Binary or memory string: C:\vmware\AllPairVPNGit\Windows\pvextra\x64\Release\pvextra.pdb
Source: setupapi.dev.log.3.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.inf' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.inf'.
Source: setupapi.dev.log.3.dr	Binary or memory string: cpy: Target Path = C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563
Source: setupapi.dev.log.3.dr	Binary or memory string: sig: FilePath = C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.inf
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: {Configure Driver Configuration: vmci.install.x64.NT}
Source: svchost.exe, 00000008.00000003.2257828864.00000171C8917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ethernetwlanppipvmnetextension98}
Source: setupapi.dev.log.3.dr	Binary or memory string: idb: Created driver package object 'vmci.inf_amd64_68ed49469341f563' in SYSTEM database node.
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: Image Path = System32\drivers\vmci.sys
Source: setupapi.dev.log.3.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.cat' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.cat'.
Source: setupapi.dev.log.3.dr	Binary or memory string: sig: Catalog = C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.cat
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: Section Name = vmci.install.x64.NT
Source: setupapi.dev.log.3.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.sys' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.sys'.
Source: setupapi.dev.log.3.dr	Binary or memory string: idb: Registered driver package 'vmci.inf_amd64_68ed49469341f563' with 'oem2.inf'.
Source: svchost.exe, 00000008.00000003.2256266081.00000171C891D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @vmnetextension
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: Driver package 'vmci.inf' is configurable.
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: {Configure Driver: VMware VMCI Bus Device}
Source: is-2PSH3.tmp.2.dr	Binary or memory string: C:\vmware\AllPairVPNGit\Windows\PairVPN2_Windows\Release\PairVPN2.pdb
Source: pvextra.exe, 00000003.00000002.2276030070.0000024B76E68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: setupapi.dev.log.3.dr	Binary or memory string: inf: {Query Configurability: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.636
Source: setupapi.dev.log.3.dr	Binary or memory string: sto: {Core Driver Package Import: vmci.inf_amd64_68ed49469341f563} 11:48:39.704
Source: setupapi.dev.log.3.dr	Binary or memory string: idb: {Register Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf} 11:48:39.707
Source: setupapi.dev.log.3.dr	Binary or memory string: flq: Copying 'C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.sys' to 'C:\Windows\System32\drivers\vmci.sys'.
Source: setupapi.dev.log.3.dr	Binary or memory string: set: System Manufacturer: VMware, Inc.

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Code function: 3_2_00007FF6B05521F0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00007FF6B05521F0

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

3_2_00007FF6B0551710

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Code function: 3_2_00007FF6B055ADEC GetProcessHeap,

3_2_00007FF6B055ADEC

Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B05521F0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF6B05521F0
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B05563A0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF6B05563A0
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B05523D4 SetUnhandledExceptionFilter,	3_2_00007FF6B05523D4
Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Code function: 3_2_00007FF6B0551CA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF6B0551CA0

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Code function: 3_2_00007FF6B055F970 cpuid

3_2_00007FF6B055F970

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

3_2_00007FF6B0551290

Source: C:\Program Files (x86)\PairVPN\pvextra.exe	Queries volume information: C:\Program Files (x86)\PairVPN\pveth\pveth.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Code function: 3_2_00007FF6B05520D0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00007FF6B05520D0

Source: C:\Program Files (x86)\PairVPN\pvextra.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

Process created: C:\Windows\SysWOW64\netsh.exe "netsh.exe" advfirewall firewall add rule name="PairVPN" dir=in action=allow program="C:\Program Files (x86)\PairVPN\PairVPN.exe" enable=yes

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

Process created: C:\Windows\SysWOW64\netsh.exe "netsh.exe" advfirewall firewall add rule name="PairVPN" dir=in action=allow program="C:\Program Files (x86)\PairVPN\PairVPN.exe" enable=yes

Stealing of Sensitive Information

Modifies the DNS server

Source: C:\Windows\System32\svchost.exe

Registry value created:

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	2 Windows Service	2 Windows Service	32 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 LSASS Driver	1 Process Injection	2 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 LSASS Driver	1 Process Injection	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	3%	ReversingLabs
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	3%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\PairVPN\is-GAJBA.tmp	100%	Avira	HEUR/AGEN.1319028
C:\Program Files (x86)\PairVPN\PairVPN.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\PairVPN.exe (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\PairVPN\is-2PSH3.tmp	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\is-2PSH3.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\PairVPN\is-7A3OK.tmp	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\is-7A3OK.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\PairVPN\is-A2FHO.tmp	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\is-A2FHO.tmp	3%	Virustotal		Browse
C:\Program Files (x86)\PairVPN\is-GAJBA.tmp	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\is-GAJBA.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\PairVPN\pveth\is-UADM2.tmp	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\pveth\is-UADM2.tmp	0%	Virustotal		Browse
C:\Program Files (x86)\PairVPN\pveth\pveth.sys (copy)	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\pveth\pveth.sys (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\PairVPN\pvextra.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\pvextra.exe (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\PairVPN\unins000.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\PairVPN\unins000.exe (copy)	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-J5BNJ.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-J5BNJ.tmp\_isetup\_setup64.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39E7.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39E7.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.sys (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.sys (copy)	0%	Virustotal		Browse
C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B7E.tmp	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B7E.tmp	0%	Virustotal		Browse
C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.sys (copy)	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.sys (copy)	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://pairv.net/dev/install.php?err=t%d	0%	Virustotal		Browse
https://www.innosetup.com/	1%	Virustotal		Browse
https://pairvpn.com	0%	Virustotal		Browse
https://www.pairvpn.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pairv.net	45.33.111.235	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pairv.net/dev/install.php?err=t11037	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/maps/search/?api=1&query=%f%%2C%fcli_txt_clockInvalid	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe	false		high
https://pairv.net/dev/install.php?err=t%d	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, pvextra.exe, pvextra.exe, 00000003.00000000.2189765772.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, pvextra.exe, 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, is-GAJBA.tmp.2.dr	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false		high
https://www.remobjects.com/ps	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071977197.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071570713.0000000002750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000000.2073224935.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp.0.dr, is-7A3OK.tmp.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://pairvpn.com	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false	0%, Virustotal, Browse	unknown
https://www.innosetup.com/	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071977197.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2071570713.0000000002750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000000.2073224935.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp.0.dr, is-7A3OK.tmp.2.dr	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2006/02/devprof	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false		high
https://pairv.net/dev/install.php?err=t11037Provider	pvextra.exe, 00000003.00000002.2275353729.0000024B75259000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pairv.net/	pvextra.exe, 00000003.00000002.2276030070.0000024B76E55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false		high
https://www.google.com/maps/search/?api=1&query=%f%%2C%f	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false		high
https://www.pairvpn.com	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2368668070.00000000024F3000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2366041316.00000000025D3000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://pairv.net/dev/install.php?err=t%d/uPairVPN_cls/twintrust.dllCryptCATAdminAcquireContext2	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, pvextra.exe, 00000003.00000000.2189765772.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, pvextra.exe, 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmp, is-GAJBA.tmp.2.dr	false		unknown
https://www.pairvpn.com.https://www.pairvpn.com.https://www.pairvpn.com	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2070023257.0000000002750000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2074992354.0000000003490000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.pairvpn.comQ6O	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe, 00000000.00000003.2368668070.00000000024F3000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://pairv.net/dev/install.php?err=t11037:	pvextra.exe, 00000003.00000002.2276030070.0000024B76E40000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pairv.net/dev/install.php?err=t11037z	pvextra.exe, 00000003.00000002.2276030070.0000024B76E55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pairvpn.com%s/%ssvr_btn_offsession_pending_review_numsession_pending_review_msgInvalid	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false		low
http://schemas.xmlsoap.org/ws/2004/09/transfer/Get	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false		high
http://schemas.xmlsoap.org/ws/2005/04/discovery	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp, 00000002.00000003.2363811966.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, is-2PSH3.tmp.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.33.111.235	pairv.net	United States		63949	LINODE-APLinodeLLCUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427216
Start date and time:	2024-04-17 09:34:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
Detection:	SUS
Classification:	sus30.spyw.evad.winEXE@14/32@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 9 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINODE-APLinodeLLCUS	file.exe	Get hash	malicious	FormBook	Browse	45.33.2.79
	Ud310iQZnO.elf	Get hash	malicious	Mirai	Browse	104.237.154.16
	https://flow.page/ciminelli.us	Get hash	malicious	HTMLPhisher	Browse	139.162.156.108
	https://preview.webflow.com/preview/2024-project?utm_medium=preview_link&utm_source=designer&utm_content=2024-project&preview=2bf57169f6b59ecf9c01ab696f7c3560&workflow=preview	Get hash	malicious	HTMLPhisher	Browse	45.79.157.59
	http://45.79.163.53	Get hash	malicious	Unknown	Browse	45.79.163.53
	https://yesterwebring.neocities.org	Get hash	malicious	Phisher	Browse	173.230.140.214
	2AJt0uG0mS.elf	Get hash	malicious	Mirai	Browse	23.239.26.100
	POR5tal0Pt.elf	Get hash	malicious	Mirai	Browse	172.104.45.76
	UksgYUGMnj.elf	Get hash	malicious	Mirai	Browse	104.237.129.85
	QMrtQYunxY.exe	Get hash	malicious	FormBook	Browse	74.207.249.179

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	install_numarkidjliveii.exe	Get hash	malicious	Unknown	Browse	45.33.111.235
	TNT Invoicing_pdf.vbs	Get hash	malicious	FormBook	Browse	45.33.111.235
	Credit_Details21367163050417024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	45.33.111.235
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	45.33.111.235
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	45.33.111.235
	SecuriteInfo.com.Trojan.Inject4.54824.15312.17403.exe	Get hash	malicious	Unknown	Browse	45.33.111.235
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	45.33.111.235
	E1rGkXuAld.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	45.33.111.235
	zquitaxghu.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	45.33.111.235
	OjYcipehXr.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	45.33.111.235

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1147952
Entropy (8bit):	6.867356772385916
Encrypted:	false
SSDEEP:	24576:rMm0VNf2bNbdCEszQ/23xJGHFDStnlDDZI8AcnqYPADBA:+QVurGHFDQNlIPcnqAABA
MD5:	9A8840D016500E85FB5EC944E743687C
SHA1:	9315AD7A9CC23E8B071473C6954473039D6B0D11
SHA-256:	874A5D1DB2C90D051E02EE5F5C166553E9B0C628506995F776D99A1431536C71
SHA-512:	403FAAC4B1DF344C64A75444FD833969159CFAA9065254D367C0096B6EBD82337BC95872E523F626B3D49D50084CE4FC911F208A9598E8A15134AA11294EB00B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......77B.sV,EsV,EsV,E.0/DgV,E.0)D.V,E!>/DjV,E!>)D.V,E!>(DPV,E.0(DRV,E.0DrV,E.0-DnV,EsV-EVW,E.?%DIV,E.?.ErV,E.?.DrV,ERichsV,E........................PE..L.....e..........................................@..................................Y....@.................................t.......................^..0&...p..@....O..p....................P.......O..@...............D............................text...1........................... ..`.rdata...D.......F..................@..@.data...$.... ......................@....rsrc.............................@..@.reloc..@....p......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PairVPN\is-2PSH3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1147952
Entropy (8bit):	6.867356772385916
Encrypted:	false
SSDEEP:	24576:rMm0VNf2bNbdCEszQ/23xJGHFDStnlDDZI8AcnqYPADBA:+QVurGHFDQNlIPcnqAABA
MD5:	9A8840D016500E85FB5EC944E743687C
SHA1:	9315AD7A9CC23E8B071473C6954473039D6B0D11
SHA-256:	874A5D1DB2C90D051E02EE5F5C166553E9B0C628506995F776D99A1431536C71
SHA-512:	403FAAC4B1DF344C64A75444FD833969159CFAA9065254D367C0096B6EBD82337BC95872E523F626B3D49D50084CE4FC911F208A9598E8A15134AA11294EB00B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......77B.sV,EsV,EsV,E.0/DgV,E.0)D.V,E!>/DjV,E!>)D.V,E!>(DPV,E.0(DRV,E.0DrV,E.0-DnV,EsV-EVW,E.?%DIV,E.?.ErV,E.?.DrV,ERichsV,E........................PE..L.....e..........................................@..................................Y....@.................................t.......................^..0&...p..@....O..p....................P.......O..@...............D............................text...1........................... ..`.rdata...D.......F..................@..@.data...$.... ......................@....rsrc.............................@..@.reloc..@....p......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PairVPN\is-7A3OK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312185805413268
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYj:CtLutqgwh4NYxtJpkxhGj333TG
MD5:	5AF6B7226BB688D27B4A5B9BF16C0A9B
SHA1:	A85775EE3158F2E4F7F301467C060592010C9767
SHA-256:	E22CDD8D9A9732AFC9DC52A07CDD20A38EE1C5381C201652D054E32033224F33
SHA-512:	20DB8EEE3B47DE4EA28344C15EA564FFEF49DD1DE6D276747DDDD5D83EA6CF3F02CD20CCBA9AED6D3A5892B26310B34CB118077B205D2E4EE2966E5573C645BE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Program Files (x86)\PairVPN\is-A2FHO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	4.945465874670498
Encrypted:	false
SSDEEP:	192:l93HSIibyW7BXTHLSdKfZQ78Dl1h1LYBb6JWBqI6jmy2E+A+Ye8w/M565tXU/E0G:b3oysBXTHF68p1Lv28woY50pY1
MD5:	60801C3073EA6124FE5948FDE22934E9
SHA1:	30990A0B53734A6F3B0976A915D05EA9EE6625F1
SHA-256:	5A7D1665F480E526D9C8E6930099B28CB2ED8DB75BFBB9B39E05820B53A217D2
SHA-512:	4E705767888B97B4FFE9B87851837360EA4FDC1B4E78B7CDA6E587B76AEB637052DD7446189B768EAECD040135CC6FC7B5A69EA56A7FB4FBCD7D423A572FB50D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.V...8S..8S..8Sv..Su.8S-.=Rh.8S-.<Ru.8S-.;R}.8S-.9R{.8S..9Rz.8S..9S4.8S..1R~.8S...S~.8S..:R~.8SRich..8S........PE..d.....U^.........."..........*.................@..........................................`..................................................>.......p.......`..p...............D...`5..p............................5...............0..X............................text...D........................... ..`.rdata.......0......................@..@.data...0....P.......8..............@....pdata..p....`.......:..............@..@.rsrc........p.......>..............@..@.reloc..D............@..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PairVPN\is-GAJBA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209408
Entropy (8bit):	5.533872822447219
Encrypted:	false
SSDEEP:	1536:8lKrqE8q6Sha/8IL316xl2Fnux90csWK5d9msWB7vdP9dlIgVqGpWtWC:vrqEZa8S316xlsnc90cbKNWFvu1uWMC
MD5:	CB12C48A9D14A5018DD07BBB8E71AC9A
SHA1:	8F19EB07279994DE814DADF70A8E2D09498907E3
SHA-256:	03922C20C2704C1B6359493BF310B4E00E902A3F4521864B2BC7F848FE833E7B
SHA-512:	B7C2DED22BBCAC15FF67FACBA985671B2A9FF929CA920D4C29BC607EECA9153011C2A5D786EE496100DE4154B41EF2A6F1375AE5F8D81ABF5D47A155897FA5F4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.).P.z.P.z.P.z.6.{.P.z.6.{.P.z.6.{AP.z.8.{.P.z.8.{.P.z.8.{.P.z.6.{.P.z.P.z.P.zR9.{.P.zR9tz.P.z.P.z.P.zR9.{.P.zRich.P.z................PE..d.....O_.........."..........H.................@.............................p............`..............................................................q...................`......@...p............................................... ............................text............................... ..`.rdata..F...........................@..@.data...............................@....pdata..............................@..@.rsrc....q.......r..................@..@.reloc.......`.......*..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\PairVPN\pveth\is-4G4HM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	5.036760290988427
Encrypted:	false
SSDEEP:	48:BqdTNZJhkQRUHyb1hdDOYQzPX6WOudD4NDfaibY1ywuHIRM+le6L1DkdjovY7pBL:kTNZ3XGHm1hdDkTSUM+fDk9WYKE
MD5:	3EC4D1E00F0735F5C53AEA8F19A03C59
SHA1:	F2F32A3F0F66923F998CFB2E6A8741E79126E473
SHA-256:	00006A2871E3A29BBE60E3F7447748DC9E91B5BE5E5D55D8C0C7098F31D209D9
SHA-512:	F39F23E0F5AFC9E781764AF48CBF15DDEC02B39E01D87A8711C9724A2F9D4DB90784336C76AAC6609A31FAC37E95D4AF0B50D2269C074F5250970BD7DDEBF6F0
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; pveth.INF..;..; PairVPN Network Driver 1.8.3.0..;..; Copyright (c) Mobile Company. All rights reserved.......[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %moco%..DriverVer =09/01/2020,1.8.3.0..PnpLockDown = 1..CatalogFile = pveth.cat....[ControlFlags]..ExcludeFromSelect={b85b7c50-6a01-11d2-b841-00c04fad5171}\pveth....[Manufacturer]..%moco% = moco,NTx86,NTamd64....;For WinXP and later....[moco.NTx86]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[moco.NTamd64]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[pveth.ndi]..Characteristics = 0x1 ; NCF_VIRTUAL..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0x0 ; NdisMedium802_3..*PhysicalMediaType = 14 ; NdisPhysicalMedium802_3..AddReg = pveth.Reg..CopyFiles = pveth.CopyFiles....[pveth.ndi.S

C:\Program Files (x86)\PairVPN\pveth\is-5S3BL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	data
Category:	dropped
Size (bytes):	10666
Entropy (8bit):	7.23347759596793
Encrypted:	false
SSDEEP:	192:fzhggOvGJC2p5UEwQl/WGhYCBsjoIVFWSqnajKsuNq:CGbpzlnh3BeoiFWSlGsuNq
MD5:	D33544EEFF39BC7FEC9FB5867DFD4B30
SHA1:	28C3FC36F1CE70971DB9E61774DC103B82F7CFCE
SHA-256:	0CA6761C7014FCF7DCB249FDE196A7D22C49C1F0648792BEA2992ECA602FD15F
SHA-512:	3F8216FF9D86AD88064A8516365F1DD8A37F993D602F813FF920BA7D2A3C015385C78A8C72A7BEDA948755DECEFEB83A7CF2F2EB28566D555CA68DFABC2DBF0E
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0.....+.....7......0...0...+.....7.....j'..im.D....."....200902174831Z0...+.....7.....0..?0... ..j(q..`..DwH....^]U.....1...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..j(q..`..DwH....^]U.....1...0.... eX.&.....R.\|.z.`..j:.B(.....0.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... eX.&.....R.\|.z.`..j:.B(.....0.0......?.f.?....j.A.&.s1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0......n..d....dKW@0....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s......u0..q0....+.....7......0.....S.u.

C:\Program Files (x86)\PairVPN\pveth\is-UADM2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	6.370268922030891
Encrypted:	false
SSDEEP:	768:9ppWW+HjJRJhulHYUloSWJhTABDpk5p33AHP8:ZWWAil4DWBNk5tu8
MD5:	7463FB1A145EB8518CFE98CA0F116604
SHA1:	765DF430641F55FE196185635F75F732CF4ABC4B
SHA-256:	9138ADCF80DBB919EB5C85C5745B7DB25C6FF60919DFBC5EC8B8D64FB0411071
SHA-512:	E8A6327844A89C9A668DAA2DA3F38999E9AEB4E2FE7477E1A2BDDCFA15B4CAF247A7F8FB072AB6C2C33209293A7D56936077E9ECB0BD6A773FDE42886E8EEF68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}.{_}.{_}.{_}.z_?.{_..z^x.{_...^x.{_..x^y.{_...^z.{_.._\|.{_..y^\|.{_Rich}.{_........PE..d....O_.........."......l... .................@....................................q.....`A................................................P...<.......X....p...........$...... ...0S..8...........................pS...............P.. ............................text....5.......6.................. ..h.rdata.......P.......:..............@..H.data........`.......F..............@....pdata.......p.......H..............@..HPAGE.....&.......(...N.............. ..`INIT....~............v.............. ..b.rsrc...X...........................@..B.reloc.. ...........................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\PairVPN\pveth\pveth.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	data
Category:	dropped
Size (bytes):	10666
Entropy (8bit):	7.23347759596793
Encrypted:	false
SSDEEP:	192:fzhggOvGJC2p5UEwQl/WGhYCBsjoIVFWSqnajKsuNq:CGbpzlnh3BeoiFWSlGsuNq
MD5:	D33544EEFF39BC7FEC9FB5867DFD4B30
SHA1:	28C3FC36F1CE70971DB9E61774DC103B82F7CFCE
SHA-256:	0CA6761C7014FCF7DCB249FDE196A7D22C49C1F0648792BEA2992ECA602FD15F
SHA-512:	3F8216FF9D86AD88064A8516365F1DD8A37F993D602F813FF920BA7D2A3C015385C78A8C72A7BEDA948755DECEFEB83A7CF2F2EB28566D555CA68DFABC2DBF0E
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0.....+.....7......0...0...+.....7.....j'..im.D....."....200902174831Z0...+.....7.....0..?0... ..j(q..`..DwH....^]U.....1...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..j(q..`..DwH....^]U.....1...0.... eX.&.....R.\|.z.`..j:.B(.....0.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... eX.&.....R.\|.z.`..j:.B(.....0.0......?.f.?....j.A.&.s1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0......n..d....dKW@0....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s......u0..q0....+.....7......0.....S.u.

C:\Program Files (x86)\PairVPN\pveth\pveth.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	5.036760290988427
Encrypted:	false
SSDEEP:	48:BqdTNZJhkQRUHyb1hdDOYQzPX6WOudD4NDfaibY1ywuHIRM+le6L1DkdjovY7pBL:kTNZ3XGHm1hdDkTSUM+fDk9WYKE
MD5:	3EC4D1E00F0735F5C53AEA8F19A03C59
SHA1:	F2F32A3F0F66923F998CFB2E6A8741E79126E473
SHA-256:	00006A2871E3A29BBE60E3F7447748DC9E91B5BE5E5D55D8C0C7098F31D209D9
SHA-512:	F39F23E0F5AFC9E781764AF48CBF15DDEC02B39E01D87A8711C9724A2F9D4DB90784336C76AAC6609A31FAC37E95D4AF0B50D2269C074F5250970BD7DDEBF6F0
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; pveth.INF..;..; PairVPN Network Driver 1.8.3.0..;..; Copyright (c) Mobile Company. All rights reserved.......[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %moco%..DriverVer =09/01/2020,1.8.3.0..PnpLockDown = 1..CatalogFile = pveth.cat....[ControlFlags]..ExcludeFromSelect={b85b7c50-6a01-11d2-b841-00c04fad5171}\pveth....[Manufacturer]..%moco% = moco,NTx86,NTamd64....;For WinXP and later....[moco.NTx86]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[moco.NTamd64]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[pveth.ndi]..Characteristics = 0x1 ; NCF_VIRTUAL..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0x0 ; NdisMedium802_3..*PhysicalMediaType = 14 ; NdisPhysicalMedium802_3..AddReg = pveth.Reg..CopyFiles = pveth.CopyFiles....[pveth.ndi.S

C:\Program Files (x86)\PairVPN\pveth\pveth.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	6.370268922030891
Encrypted:	false
SSDEEP:	768:9ppWW+HjJRJhulHYUloSWJhTABDpk5p33AHP8:ZWWAil4DWBNk5tu8
MD5:	7463FB1A145EB8518CFE98CA0F116604
SHA1:	765DF430641F55FE196185635F75F732CF4ABC4B
SHA-256:	9138ADCF80DBB919EB5C85C5745B7DB25C6FF60919DFBC5EC8B8D64FB0411071
SHA-512:	E8A6327844A89C9A668DAA2DA3F38999E9AEB4E2FE7477E1A2BDDCFA15B4CAF247A7F8FB072AB6C2C33209293A7D56936077E9ECB0BD6A773FDE42886E8EEF68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}.{_}.{_}.{_}.z_?.{_..z^x.{_...^x.{_..x^y.{_...^z.{_.._\|.{_..y^\|.{_Rich}.{_........PE..d....O_.........."......l... .................@....................................q.....`A................................................P...<.......X....p...........$...... ...0S..8...........................pS...............P.. ............................text....5.......6.................. ..h.rdata.......P.......:..............@..H.data........`.......F..............@....pdata.......p.......H..............@..HPAGE.....&.......(...N.............. ..`INIT....~............v.............. ..b.rsrc...X...........................@..B.reloc.. ...........................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\PairVPN\pvextra.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209408
Entropy (8bit):	5.533872822447219
Encrypted:	false
SSDEEP:	1536:8lKrqE8q6Sha/8IL316xl2Fnux90csWK5d9msWB7vdP9dlIgVqGpWtWC:vrqEZa8S316xlsnc90cbKNWFvu1uWMC
MD5:	CB12C48A9D14A5018DD07BBB8E71AC9A
SHA1:	8F19EB07279994DE814DADF70A8E2D09498907E3
SHA-256:	03922C20C2704C1B6359493BF310B4E00E902A3F4521864B2BC7F848FE833E7B
SHA-512:	B7C2DED22BBCAC15FF67FACBA985671B2A9FF929CA920D4C29BC607EECA9153011C2A5D786EE496100DE4154B41EF2A6F1375AE5F8D81ABF5D47A155897FA5F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.).P.z.P.z.P.z.6.{.P.z.6.{.P.z.6.{AP.z.8.{.P.z.8.{.P.z.8.{.P.z.6.{.P.z.P.z.P.zR9.{.P.zR9tz.P.z.P.z.P.zR9.{.P.zRich.P.z................PE..d.....O_.........."..........H.................@.............................p............`..............................................................q...................`......@...p............................................... ............................text............................... ..`.rdata..F...........................@..@.data...............................@....pdata..............................@..@.rsrc....q.......r..................@..@.reloc.......`.......*..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\PairVPN\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312185805413268
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYj:CtLutqgwh4NYxtJpkxhGj333TG
MD5:	5AF6B7226BB688D27B4A5B9BF16C0A9B
SHA1:	A85775EE3158F2E4F7F301467C060592010C9767
SHA-256:	E22CDD8D9A9732AFC9DC52A07CDD20A38EE1C5381C201652D054E32033224F33
SHA-512:	20DB8EEE3B47DE4EA28344C15EA564FFEF49DD1DE6D276747DDDD5D83EA6CF3F02CD20CCBA9AED6D3A5892B26310B34CB118077B205D2E4EE2966E5573C645BE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.3250653227668945
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	74F03B0063ABA7C8CC9A8D4FED6B2381
SHA1:	7296C58160C9CC7C45313E4064BAB6CE265D0285
SHA-256:	A610FC722A9A367897078807925DE65C8F286DA2C1CADB18989AE0C34306046A
SHA-512:	05B408070DCF76C72E4664CCC57367F421034C8C4A3AB00A849A2B2794A64DCC753390B7F54D8C2CAB31BFFB6C575E5B61BC810B5989D9158CFED04072C5467C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-J5BNJ.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39C6.tmp

Download File

Process:	C:\Program Files (x86)\PairVPN\pvextra.exe
File Type:	data
Category:	dropped
Size (bytes):	10666
Entropy (8bit):	7.23347759596793
Encrypted:	false
SSDEEP:	192:fzhggOvGJC2p5UEwQl/WGhYCBsjoIVFWSqnajKsuNq:CGbpzlnh3BeoiFWSlGsuNq
MD5:	D33544EEFF39BC7FEC9FB5867DFD4B30
SHA1:	28C3FC36F1CE70971DB9E61774DC103B82F7CFCE
SHA-256:	0CA6761C7014FCF7DCB249FDE196A7D22C49C1F0648792BEA2992ECA602FD15F
SHA-512:	3F8216FF9D86AD88064A8516365F1DD8A37F993D602F813FF920BA7D2A3C015385C78A8C72A7BEDA948755DECEFEB83A7CF2F2EB28566D555CA68DFABC2DBF0E
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0.....+.....7......0...0...+.....7.....j'..im.D....."....200902174831Z0...+.....7.....0..?0... ..j(q..`..DwH....^]U.....1...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..j(q..`..DwH....^]U.....1...0.... eX.&.....R.\|.z.`..j:.B(.....0.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... eX.&.....R.\|.z.`..j:.B(.....0.0......?.f.?....j.A.&.s1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0......n..d....dKW@0....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s......u0..q0....+.....7......0.....S.u.

C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39D7.tmp

Download File

Process:	C:\Program Files (x86)\PairVPN\pvextra.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	5.036760290988427
Encrypted:	false
SSDEEP:	48:BqdTNZJhkQRUHyb1hdDOYQzPX6WOudD4NDfaibY1ywuHIRM+le6L1DkdjovY7pBL:kTNZ3XGHm1hdDkTSUM+fDk9WYKE
MD5:	3EC4D1E00F0735F5C53AEA8F19A03C59
SHA1:	F2F32A3F0F66923F998CFB2E6A8741E79126E473
SHA-256:	00006A2871E3A29BBE60E3F7447748DC9E91B5BE5E5D55D8C0C7098F31D209D9
SHA-512:	F39F23E0F5AFC9E781764AF48CBF15DDEC02B39E01D87A8711C9724A2F9D4DB90784336C76AAC6609A31FAC37E95D4AF0B50D2269C074F5250970BD7DDEBF6F0
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; pveth.INF..;..; PairVPN Network Driver 1.8.3.0..;..; Copyright (c) Mobile Company. All rights reserved.......[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %moco%..DriverVer =09/01/2020,1.8.3.0..PnpLockDown = 1..CatalogFile = pveth.cat....[ControlFlags]..ExcludeFromSelect={b85b7c50-6a01-11d2-b841-00c04fad5171}\pveth....[Manufacturer]..%moco% = moco,NTx86,NTamd64....;For WinXP and later....[moco.NTx86]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[moco.NTamd64]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[pveth.ndi]..Characteristics = 0x1 ; NCF_VIRTUAL..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0x0 ; NdisMedium802_3..*PhysicalMediaType = 14 ; NdisPhysicalMedium802_3..AddReg = pveth.Reg..CopyFiles = pveth.CopyFiles....[pveth.ndi.S

C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39E7.tmp

Download File

Process:	C:\Program Files (x86)\PairVPN\pvextra.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	6.370268922030891
Encrypted:	false
SSDEEP:	768:9ppWW+HjJRJhulHYUloSWJhTABDpk5p33AHP8:ZWWAil4DWBNk5tu8
MD5:	7463FB1A145EB8518CFE98CA0F116604
SHA1:	765DF430641F55FE196185635F75F732CF4ABC4B
SHA-256:	9138ADCF80DBB919EB5C85C5745B7DB25C6FF60919DFBC5EC8B8D64FB0411071
SHA-512:	E8A6327844A89C9A668DAA2DA3F38999E9AEB4E2FE7477E1A2BDDCFA15B4CAF247A7F8FB072AB6C2C33209293A7D56936077E9ECB0BD6A773FDE42886E8EEF68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}.{_}.{_}.{_}.z_?.{_..z^x.{_...^x.{_..x^y.{_...^z.{_.._\|.{_..y^\|.{_Rich}.{_........PE..d....O_.........."......l... .................@....................................q.....`A................................................P...<.......X....p...........$...... ...0S..8...........................pS...............P.. ............................text....5.......6.................. ..h.rdata.......P.......:..............@..H.data........`.......F..............@....pdata.......p.......H..............@..HPAGE.....&.......(...N.............. ..`INIT....~............v.............. ..b.rsrc...X...........................@..B.reloc.. ...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.cat (copy)

Download File

Process:	C:\Program Files (x86)\PairVPN\pvextra.exe
File Type:	data
Category:	dropped
Size (bytes):	10666
Entropy (8bit):	7.23347759596793
Encrypted:	false
SSDEEP:	192:fzhggOvGJC2p5UEwQl/WGhYCBsjoIVFWSqnajKsuNq:CGbpzlnh3BeoiFWSlGsuNq
MD5:	D33544EEFF39BC7FEC9FB5867DFD4B30
SHA1:	28C3FC36F1CE70971DB9E61774DC103B82F7CFCE
SHA-256:	0CA6761C7014FCF7DCB249FDE196A7D22C49C1F0648792BEA2992ECA602FD15F
SHA-512:	3F8216FF9D86AD88064A8516365F1DD8A37F993D602F813FF920BA7D2A3C015385C78A8C72A7BEDA948755DECEFEB83A7CF2F2EB28566D555CA68DFABC2DBF0E
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0.....+.....7......0...0...+.....7.....j'..im.D....."....200902174831Z0...+.....7.....0..?0... ..j(q..`..DwH....^]U.....1...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..j(q..`..DwH....^]U.....1...0.... eX.&.....R.\|.z.`..j:.B(.....0.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... eX.&.....R.\|.z.`..j:.B(.....0.0......?.f.?....j.A.&.s1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0......n..d....dKW@0....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s......u0..q0....+.....7......0.....S.u.

C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.inf (copy)

Download File

Process:	C:\Program Files (x86)\PairVPN\pvextra.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	5.036760290988427
Encrypted:	false
SSDEEP:	48:BqdTNZJhkQRUHyb1hdDOYQzPX6WOudD4NDfaibY1ywuHIRM+le6L1DkdjovY7pBL:kTNZ3XGHm1hdDkTSUM+fDk9WYKE
MD5:	3EC4D1E00F0735F5C53AEA8F19A03C59
SHA1:	F2F32A3F0F66923F998CFB2E6A8741E79126E473
SHA-256:	00006A2871E3A29BBE60E3F7447748DC9E91B5BE5E5D55D8C0C7098F31D209D9
SHA-512:	F39F23E0F5AFC9E781764AF48CBF15DDEC02B39E01D87A8711C9724A2F9D4DB90784336C76AAC6609A31FAC37E95D4AF0B50D2269C074F5250970BD7DDEBF6F0
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; pveth.INF..;..; PairVPN Network Driver 1.8.3.0..;..; Copyright (c) Mobile Company. All rights reserved.......[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %moco%..DriverVer =09/01/2020,1.8.3.0..PnpLockDown = 1..CatalogFile = pveth.cat....[ControlFlags]..ExcludeFromSelect={b85b7c50-6a01-11d2-b841-00c04fad5171}\pveth....[Manufacturer]..%moco% = moco,NTx86,NTamd64....;For WinXP and later....[moco.NTx86]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[moco.NTamd64]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[pveth.ndi]..Characteristics = 0x1 ; NCF_VIRTUAL..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0x0 ; NdisMedium802_3..*PhysicalMediaType = 14 ; NdisPhysicalMedium802_3..AddReg = pveth.Reg..CopyFiles = pveth.CopyFiles....[pveth.ndi.S

C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.sys (copy)

Download File

Process:	C:\Program Files (x86)\PairVPN\pvextra.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	6.370268922030891
Encrypted:	false
SSDEEP:	768:9ppWW+HjJRJhulHYUloSWJhTABDpk5p33AHP8:ZWWAil4DWBNk5tu8
MD5:	7463FB1A145EB8518CFE98CA0F116604
SHA1:	765DF430641F55FE196185635F75F732CF4ABC4B
SHA-256:	9138ADCF80DBB919EB5C85C5745B7DB25C6FF60919DFBC5EC8B8D64FB0411071
SHA-512:	E8A6327844A89C9A668DAA2DA3F38999E9AEB4E2FE7477E1A2BDDCFA15B4CAF247A7F8FB072AB6C2C33209293A7D56936077E9ECB0BD6A773FDE42886E8EEF68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}.{_}.{_}.{_}.z_?.{_..z^x.{_...^x.{_..x^y.{_...^z.{_.._\|.{_..y^\|.{_Rich}.{_........PE..d....O_.........."......l... .................@....................................q.....`A................................................P...<.......X....p...........$...... ...0S..8...........................pS...............P.. ............................text....5.......6.................. ..h.rdata.......P.......:..............@..H.data........`.......F..............@....pdata.......p.......H..............@..HPAGE.....&.......(...N.............. ..`INIT....~............v.............. ..b.rsrc...X...........................@..B.reloc.. ...........................@..B........................................................................................................................................................................................................

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	5.036760290988427
Encrypted:	false
SSDEEP:	48:BqdTNZJhkQRUHyb1hdDOYQzPX6WOudD4NDfaibY1ywuHIRM+le6L1DkdjovY7pBL:kTNZ3XGHm1hdDkTSUM+fDk9WYKE
MD5:	3EC4D1E00F0735F5C53AEA8F19A03C59
SHA1:	F2F32A3F0F66923F998CFB2E6A8741E79126E473
SHA-256:	00006A2871E3A29BBE60E3F7447748DC9E91B5BE5E5D55D8C0C7098F31D209D9
SHA-512:	F39F23E0F5AFC9E781764AF48CBF15DDEC02B39E01D87A8711C9724A2F9D4DB90784336C76AAC6609A31FAC37E95D4AF0B50D2269C074F5250970BD7DDEBF6F0
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; pveth.INF..;..; PairVPN Network Driver 1.8.3.0..;..; Copyright (c) Mobile Company. All rights reserved.......[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %moco%..DriverVer =09/01/2020,1.8.3.0..PnpLockDown = 1..CatalogFile = pveth.cat....[ControlFlags]..ExcludeFromSelect={b85b7c50-6a01-11d2-b841-00c04fad5171}\pveth....[Manufacturer]..%moco% = moco,NTx86,NTamd64....;For WinXP and later....[moco.NTx86]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[moco.NTamd64]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[pveth.ndi]..Characteristics = 0x1 ; NCF_VIRTUAL..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0x0 ; NdisMedium802_3..*PhysicalMediaType = 14 ; NdisPhysicalMedium802_3..AddReg = pveth.Reg..CopyFiles = pveth.CopyFiles....[pveth.ndi.S

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files (x86)\PairVPN\pvextra.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	58199
Entropy (8bit):	5.2147776008671105
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwrzUQ5SE2e36tpzOxLiQRAjv:Own95cdyYloiwnlz2e6z2aL
MD5:	539418DB80E0FBE8F3A6E0F71E0C7310
SHA1:	6D7FAB7C91A753F7FDD402CDD20C059D377F4C35
SHA-256:	DE293582225E4E44FB7EE61ACF3A21A170ADCD96DF136A187B630990DEE55389
SHA-512:	3636CE5426DD8CFBFD720735C7BA61463517A3B9FB57D36CAC776AA801CEF5A379C8F1C6B5EE7F84EBD3C6B62FC08F7CC87596613AA1316A891F6D1BB2A3A885
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Logs\NetSetup\service.0.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.424521281982306
Encrypted:	false
SSDEEP:	192:aL/zm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbmku0L:aL/ZM7mjhRoZO/oAPbL
MD5:	B8E18274226C4067BECF6D8EBFB6B092
SHA1:	022F4A8AF4C34FA3EFD49F868CF118897BCCF4D7
SHA-256:	54770652DACDE2D5A50CC7F16EBCAB5389B058D655D0A8AEE87AEBE6581EEA29
SHA-512:	C2F22CF11A46E0C3FBD1C69B21D9B4593A2A53F0FEFEEFCF3A3A22C1F31C696C7318A4ED00416666FBE0128207C7DDF56B9B61E8592691432B8399942F60EDB3
Malicious:	false
Preview:	....8...8...........................................!....................................?......................eJ......y......Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....7.@..?.......I.[.8+m.!N8$......NetSetupuser.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.db......4.@..?.........E_iC...F........NetSetupSvc.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B5C.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10666
Entropy (8bit):	7.23347759596793
Encrypted:	false
SSDEEP:	192:fzhggOvGJC2p5UEwQl/WGhYCBsjoIVFWSqnajKsuNq:CGbpzlnh3BeoiFWSlGsuNq
MD5:	D33544EEFF39BC7FEC9FB5867DFD4B30
SHA1:	28C3FC36F1CE70971DB9E61774DC103B82F7CFCE
SHA-256:	0CA6761C7014FCF7DCB249FDE196A7D22C49C1F0648792BEA2992ECA602FD15F
SHA-512:	3F8216FF9D86AD88064A8516365F1DD8A37F993D602F813FF920BA7D2A3C015385C78A8C72A7BEDA948755DECEFEB83A7CF2F2EB28566D555CA68DFABC2DBF0E
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0.....+.....7......0...0...+.....7.....j'..im.D....."....200902174831Z0...+.....7.....0..?0... ..j(q..`..DwH....^]U.....1...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..j(q..`..DwH....^]U.....1...0.... eX.&.....R.\|.z.`..j:.B(.....0.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... eX.&.....R.\|.z.`..j:.B(.....0.0......?.f.?....j.A.&.s1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0......n..d....dKW@0....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s......u0..q0....+.....7......0.....S.u.

C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B6D.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	5.036760290988427
Encrypted:	false
SSDEEP:	48:BqdTNZJhkQRUHyb1hdDOYQzPX6WOudD4NDfaibY1ywuHIRM+le6L1DkdjovY7pBL:kTNZ3XGHm1hdDkTSUM+fDk9WYKE
MD5:	3EC4D1E00F0735F5C53AEA8F19A03C59
SHA1:	F2F32A3F0F66923F998CFB2E6A8741E79126E473
SHA-256:	00006A2871E3A29BBE60E3F7447748DC9E91B5BE5E5D55D8C0C7098F31D209D9
SHA-512:	F39F23E0F5AFC9E781764AF48CBF15DDEC02B39E01D87A8711C9724A2F9D4DB90784336C76AAC6609A31FAC37E95D4AF0B50D2269C074F5250970BD7DDEBF6F0
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; pveth.INF..;..; PairVPN Network Driver 1.8.3.0..;..; Copyright (c) Mobile Company. All rights reserved.......[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %moco%..DriverVer =09/01/2020,1.8.3.0..PnpLockDown = 1..CatalogFile = pveth.cat....[ControlFlags]..ExcludeFromSelect={b85b7c50-6a01-11d2-b841-00c04fad5171}\pveth....[Manufacturer]..%moco% = moco,NTx86,NTamd64....;For WinXP and later....[moco.NTx86]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[moco.NTamd64]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[pveth.ndi]..Characteristics = 0x1 ; NCF_VIRTUAL..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0x0 ; NdisMedium802_3..*PhysicalMediaType = 14 ; NdisPhysicalMedium802_3..AddReg = pveth.Reg..CopyFiles = pveth.CopyFiles....[pveth.ndi.S

C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\SET3B7E.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	6.370268922030891
Encrypted:	false
SSDEEP:	768:9ppWW+HjJRJhulHYUloSWJhTABDpk5p33AHP8:ZWWAil4DWBNk5tu8
MD5:	7463FB1A145EB8518CFE98CA0F116604
SHA1:	765DF430641F55FE196185635F75F732CF4ABC4B
SHA-256:	9138ADCF80DBB919EB5C85C5745B7DB25C6FF60919DFBC5EC8B8D64FB0411071
SHA-512:	E8A6327844A89C9A668DAA2DA3F38999E9AEB4E2FE7477E1A2BDDCFA15B4CAF247A7F8FB072AB6C2C33209293A7D56936077E9ECB0BD6A773FDE42886E8EEF68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}.{_}.{_}.{_}.z_?.{_..z^x.{_...^x.{_..x^y.{_...^z.{_.._\|.{_..y^\|.{_Rich}.{_........PE..d....O_.........."......l... .................@....................................q.....`A................................................P...<.......X....p...........$...... ...0S..8...........................pS...............P.. ............................text....5.......6.................. ..h.rdata.......P.......:..............@..H.data........`.......F..............@....pdata.......p.......H..............@..HPAGE.....&.......(...N.............. ..`INIT....~............v.............. ..b.rsrc...X...........................@..B.reloc.. ...........................@..B........................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10666
Entropy (8bit):	7.23347759596793
Encrypted:	false
SSDEEP:	192:fzhggOvGJC2p5UEwQl/WGhYCBsjoIVFWSqnajKsuNq:CGbpzlnh3BeoiFWSlGsuNq
MD5:	D33544EEFF39BC7FEC9FB5867DFD4B30
SHA1:	28C3FC36F1CE70971DB9E61774DC103B82F7CFCE
SHA-256:	0CA6761C7014FCF7DCB249FDE196A7D22C49C1F0648792BEA2992ECA602FD15F
SHA-512:	3F8216FF9D86AD88064A8516365F1DD8A37F993D602F813FF920BA7D2A3C015385C78A8C72A7BEDA948755DECEFEB83A7CF2F2EB28566D555CA68DFABC2DBF0E
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0.....+.....7......0...0...+.....7.....j'..im.D....."....200902174831Z0...+.....7.....0..?0... ..j(q..`..DwH....^]U.....1...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..j(q..`..DwH....^]U.....1...0.... eX.&.....R.\|.z.`..j:.B(.....0.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... eX.&.....R.\|.z.`..j:.B(.....0.0......?.f.?....j.A.&.s1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...i.n.f...0......n..d....dKW@0....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........p.v.e.t.h...s.y.s......u0..q0....+.....7......0.....S.u.

C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	5.036760290988427
Encrypted:	false
SSDEEP:	48:BqdTNZJhkQRUHyb1hdDOYQzPX6WOudD4NDfaibY1ywuHIRM+le6L1DkdjovY7pBL:kTNZ3XGHm1hdDkTSUM+fDk9WYKE
MD5:	3EC4D1E00F0735F5C53AEA8F19A03C59
SHA1:	F2F32A3F0F66923F998CFB2E6A8741E79126E473
SHA-256:	00006A2871E3A29BBE60E3F7447748DC9E91B5BE5E5D55D8C0C7098F31D209D9
SHA-512:	F39F23E0F5AFC9E781764AF48CBF15DDEC02B39E01D87A8711C9724A2F9D4DB90784336C76AAC6609A31FAC37E95D4AF0B50D2269C074F5250970BD7DDEBF6F0
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; pveth.INF..;..; PairVPN Network Driver 1.8.3.0..;..; Copyright (c) Mobile Company. All rights reserved.......[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %moco%..DriverVer =09/01/2020,1.8.3.0..PnpLockDown = 1..CatalogFile = pveth.cat....[ControlFlags]..ExcludeFromSelect={b85b7c50-6a01-11d2-b841-00c04fad5171}\pveth....[Manufacturer]..%moco% = moco,NTx86,NTamd64....;For WinXP and later....[moco.NTx86]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[moco.NTamd64]..%pveth.DeviceDesc% = pveth.ndi, pveth ; Root enumerated ....[pveth.ndi]..Characteristics = 0x1 ; NCF_VIRTUAL..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0x0 ; NdisMedium802_3..*PhysicalMediaType = 14 ; NdisPhysicalMedium802_3..AddReg = pveth.Reg..CopyFiles = pveth.CopyFiles....[pveth.ndi.S

C:\Windows\System32\DriverStore\Temp\{52c0b4ce-4a56-b642-98c5-a3179f85b29e}\pveth.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	6.370268922030891
Encrypted:	false
SSDEEP:	768:9ppWW+HjJRJhulHYUloSWJhTABDpk5p33AHP8:ZWWAil4DWBNk5tu8
MD5:	7463FB1A145EB8518CFE98CA0F116604
SHA1:	765DF430641F55FE196185635F75F732CF4ABC4B
SHA-256:	9138ADCF80DBB919EB5C85C5745B7DB25C6FF60919DFBC5EC8B8D64FB0411071
SHA-512:	E8A6327844A89C9A668DAA2DA3F38999E9AEB4E2FE7477E1A2BDDCFA15B4CAF247A7F8FB072AB6C2C33209293A7D56936077E9ECB0BD6A773FDE42886E8EEF68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}.{_}.{_}.{_}.z_?.{_..z^x.{_...^x.{_..x^y.{_...^z.{_.._\|.{_..y^\|.{_Rich}.{_........PE..d....O_.........."......l... .................@....................................q.....`A................................................P...<.......X....p...........$...... ...0S..8...........................pS...............P.. ............................text....5.......6.................. ..h.rdata.......P.......:..............@..H.data........`.......F..............@....pdata.......p.......H..............@..HPAGE.....&.......(...N.............. ..`INIT....~............v.............. ..b.rsrc...X...........................@..B.reloc.. ...........................@..B........................................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3474
Entropy (8bit):	5.365681392567107
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3s5pmspmZp:QO00eO00erMwmkB1kAf
MD5:	D506C8E42202131C1BD3E6641AD304ED
SHA1:	C7F77095E1DB8EFDE53AEBFC20C3D0D0B6AD8B17
SHA-256:	4C4B89F08299EB005070E05FA9813ABF1E0FAF485D6A5186FE998075E8F3AD78
SHA-512:	51B37D3AA7A7623A59A9F10BB246C4701D3574A85DC13690E491814A75834D08C1FDBCA2A74288AA96961D8FAF7C3EACC16E533BFE6F2F66A7B2C9A8CC7F1F36
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.649182860235832
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
File size:	2'341'000 bytes
MD5:	35a00ae36ee03f200bad5a922afacd04
SHA1:	05dd9e5eae8378394d9426fd97e18d2d485db3fa
SHA256:	c99b0aea44483bd5145b0bd811ad6b0fe4b7aa5867a4f12e979fbbea9648ad02
SHA512:	23b48e6a66b9baa94b08c714b4a651d4f7af8559069549b757d6f9e821bee5e9089c5e41798031b39553b1b247de9f9577d5577e853270f888bae3de80923e5a
SSDEEP:	49152:bBuZrEU4IQC1zVoxHUmQ+KIy029s4C1eH99:tkL0C1Box0mzt29s4C1eH99
TLSH:	2BB5D03BF268A13EC56A1B3245B38350997BBA61B81A8C1F07FC344DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	10/01/2024 01:00:00 21/09/2026 01:59:59
Subject Chain	CN=Mobile Company, O=Mobile Company, L=Fairfax, S=Virginia, C=US, SERIALNUMBER=08270787, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Virginia, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	2427B570B6089CC2FA6B28C8DCB2E44E
Thumbprint SHA-1:	E8849BF543ABA361317805613C4B8CD1C7580C8D
Thumbprint SHA-256:	1EB9167DE385E7FCDBEC78FA18F6238ECDDAA7D4405D257B9918AEF7E8B9D9B4
Serial:	08A121027C5108C62F730F074FDD83D0

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F5989726BE5h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F59897C96D7h
call 00007F59897C922Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F598973C684h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F59897217D7h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F598973D807h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F59897C975Fh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F59897CF97Ah
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F598973E0FCh
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x239258	0x2630
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	1c4b537707205f00cfb869176c700f60	False	0.18593462775735295	data	3.69437967057622	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.26345609065155806
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 09:35:15.773260117 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:15.773291111 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:15.773401022 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:15.787539959 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:15.787553072 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:16.263715029 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:16.263798952 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:16.272125006 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:16.272150040 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:16.272356987 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:16.272417068 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:16.273943901 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:16.320123911 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:16.430519104 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:16.430677891 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:16.430717945 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:16.430738926 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:16.430998087 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:16.431015015 CEST	443	49717	45.33.111.235	192.168.2.6
Apr 17, 2024 09:35:16.432127953 CEST	49717	443	192.168.2.6	45.33.111.235
Apr 17, 2024 09:35:16.432127953 CEST	49717	443	192.168.2.6	45.33.111.235

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 09:35:15.632772923 CEST	60867	53	192.168.2.6	1.1.1.1
Apr 17, 2024 09:35:15.768356085 CEST	53	60867	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 17, 2024 09:35:15.632772923 CEST	192.168.2.6	1.1.1.1	0x96a0	Standard query (0)	pairv.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 17, 2024 09:35:15.768356085 CEST	1.1.1.1	192.168.2.6	0x96a0	No error (0)	pairv.net		45.33.111.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pairv.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49717	45.33.111.235	443	2912	C:\Program Files (x86)\PairVPN\pvextra.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 07:35:16 UTC	86	OUT	GET /dev/install.php?err=t11037 HTTP/1.1 Host: pairv.net Cache-Control: no-cache
2024-04-17 07:35:16 UTC	236	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 07:12:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_qos/11.64 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	09:34:54
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe"
Imagebase:	0x400000
File size:	2'341'000 bytes
MD5 hash:	35A00AE36EE03F200BAD5A922AFACD04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:34:55
Start date:	17/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp" /SL5="$20404,1488690,832512,C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	74F03B0063ABA7C8CC9A8D4FED6B2381
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:35:06
Start date:	17/04/2024
Path:	C:\Program Files (x86)\PairVPN\pvextra.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\PairVPN\pvextra.exe" /d
Imagebase:	0x7ff6b0550000
File size:	209'408 bytes
MD5 hash:	CB12C48A9D14A5018DD07BBB8E71AC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:35:07
Start date:	17/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:35:07
Start date:	17/04/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\pveth.inf" "9" "4ec797a8f" "0000000000000100" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\pairvpn\pveth"
Imagebase:	0x7ff70fbb0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:35:12
Start date:	17/04/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "2" "211" "ROOT\PVETH\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:1f6a2eb20729039e:pveth.ndi:1.8.3.0:pveth," "4ec797a8f" "0000000000000100"
Imagebase:	0x7ff70fbb0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:35:13
Start date:	17/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:35:22
Start date:	17/04/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"netsh.exe" advfirewall firewall add rule name="PairVPN" dir=in action=allow program="C:\Program Files (x86)\PairVPN\PairVPN.exe" enable=yes
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:35:22
Start date:	17/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.8%
Total number of Nodes:	1069
Total number of Limit Nodes:	22

Executed Functions

Function 00007FF6B0551710 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 166
networkstringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNELBASE ref: 00007FF6B055173C
VerSetConditionMask.KERNEL32 ref: 00007FF6B0551799
VerSetConditionMask.KERNEL32 ref: 00007FF6B05517A8
VerSetConditionMask.KERNEL32 ref: 00007FF6B05517B7
VerifyVersionInfoW.KERNEL32 ref: 00007FF6B05517E0
LoadLibraryW.KERNEL32 ref: 00007FF6B05517F1
GetProcAddress.KERNEL32 ref: 00007FF6B0551809
FreeLibrary.KERNEL32 ref: 00007FF6B0551815
GetModuleFileNameW.KERNEL32 ref: 00007FF6B0551865
PathRemoveFileSpecW.SHLWAPI ref: 00007FF6B0551873
InternetOpenA.WININET ref: 00007FF6B05518EB
InternetOpenUrlA.WININET ref: 00007FF6B0551914
InternetCloseHandle.WININET ref: 00007FF6B0551922
InternetCloseHandle.WININET ref: 00007FF6B055192B
lstrcmpiW.KERNEL32 ref: 00007FF6B0551942
FindWindowW.USER32 ref: 00007FF6B0551955
PostMessageW.USER32 ref: 00007FF6B055196E
Sleep.KERNEL32 ref: 00007FF6B0551979
lstrcmpiW.KERNEL32 ref: 00007FF6B05519A2
CreateFileW.KERNEL32 ref: 00007FF6B05519E4
CloseHandle.KERNEL32 ref: 00007FF6B05519F2

Strings

CryptCATAdminAcquireContext2, xrefs: 00007FF6B05517FF
https://pairv.net/dev/install.php?err=t%d, xrefs: 00007FF6B05518C5
\\.\PVETH, xrefs: 00007FF6B05519BD
PairVPN_cls, xrefs: 00007FF6B055194E
wintrust.dll, xrefs: 00007FF6B05517EA

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: Internet$CloseConditionFileHandleMasklstrcmpi$LibraryOpen$AddressCreateFindFreeInfoLoadMessageModuleNamePathPostProcRemoveSleepSpecVerifyVersionWindow
String ID: CryptCATAdminAcquireContext2$PairVPN_cls$\\.\PVETH$https://pairv.net/dev/install.php?err=t%d$wintrust.dll
API String ID: 2313333693-2263244140
Opcode ID: bb3eec7c3492c672487cd582cc17121aa8502d23b46e23a010ff6af31e45bc6f
Instruction ID: f63c696deef449dc76503ecf3ff7db6077dc0ca3e8cf745cd4cd58818e6150c7
Opcode Fuzzy Hash: bb3eec7c3492c672487cd582cc17121aa8502d23b46e23a010ff6af31e45bc6f
Instruction Fuzzy Hash: 02812636A0C682A2EB608B29E6643BA7B61FF84780F445135CB4DC6F64EF7CD544C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0551060 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiCreateDeviceInfoList.SETUPAPI ref: 00007FF6B05510B6
GetLastError.KERNEL32 ref: 00007FF6B05510C5
SetupDiCreateDeviceInfoW.SETUPAPI ref: 00007FF6B0551101
GetLastError.KERNEL32 ref: 00007FF6B055110B
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF6B0551252

Strings

pveth, xrefs: 00007FF6B05510EF, 00007FF6B0551118, 00007FF6B0551125, 00007FF6B0551181
\\.\PVETH, xrefs: 00007FF6B0551210
r6M, xrefs: 00007FF6B05511D7

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: DeviceInfoSetup$CreateErrorLastList$Destroy
String ID: \\.\PVETH$pveth$r6M
API String ID: 239284424-1178298180
Opcode ID: 5988e6157ca7f7e794a9477beb987d82aacc090ec68ff0316e45f3fed771612b
Instruction ID: 635053fe7e5fca88cda1842447a4d6a105192e0ae7270b391d2551f10a33f5ce
Opcode Fuzzy Hash: 5988e6157ca7f7e794a9477beb987d82aacc090ec68ff0316e45f3fed771612b
Instruction Fuzzy Hash: 5F516D3AA0CA81A6EB608F29EA547A93BA5FB447A4F400231DB4DC2FA4DF3CD544C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0551290 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiGetClassDevsW.SETUPAPI ref: 00007FF6B05512D2
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF6B0551304
SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF6B055133C
wcsstr.LIBVCRUNTIME ref: 00007FF6B0551352
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF6B0551368
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF6B0551375
CM_Get_DevNode_Status.SETUPAPI ref: 00007FF6B05513C8
SetupDiSetSelectedDevice.SETUPAPI ref: 00007FF6B05513DA
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF6B05513ED
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF6B05513F6

Strings

, xrefs: 00007FF6B05512F7
PairVPN Network Adapter, xrefs: 00007FF6B0551346

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: Setup$Device$Info$ClassDestroyEnumList$CallDevsGet_InstallerNode_PropertyRegistrySelectedStatuswcsstr
String ID: $PairVPN Network Adapter
API String ID: 95707926-1194100514
Opcode ID: 0d4d26fc68ed55e62b83b69bf22d34b1c2cab50ff971402166ee3284b4ffea95
Instruction ID: 11438f5c662b55a39ef4baedfba23c200ce2816e0c86e1a3aef30697a2a3207e
Opcode Fuzzy Hash: 0d4d26fc68ed55e62b83b69bf22d34b1c2cab50ff971402166ee3284b4ffea95
Instruction Fuzzy Hash: F241623A60C642A2EB508B29F5643BA7BA0FB85794F541635DB4EC2FA4DF7CD409CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0551410 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 166
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF6B0551475
RegEnumKeyExA.KERNELBASE ref: 00007FF6B05514E7
RegOpenKeyExA.KERNELBASE ref: 00007FF6B0551560
RegQueryValueExA.KERNELBASE ref: 00007FF6B055159A
RegCloseKey.ADVAPI32 ref: 00007FF6B05515B2
RegOpenKeyExA.KERNELBASE ref: 00007FF6B0551606
RegQueryValueExA.KERNELBASE ref: 00007FF6B055163B
RegCloseKey.ADVAPI32 ref: 00007FF6B0551653

Strings

@, xrefs: 00007FF6B055153F
ComponentId, xrefs: 00007FF6B0551593
MacAddress, xrefs: 00007FF6B055162C
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}, xrefs: 00007FF6B0551468, 00007FF6B0551501
dows, xrefs: 00007FF6B05516C1
pveth, xrefs: 00007FF6B05515C8
%s\%s, xrefs: 00007FF6B055150D

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: Open$CloseQueryValue$Enum
String ID: %s\%s$@$ComponentId$MacAddress$SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}$dows$pveth
API String ID: 3519472934-49098168
Opcode ID: 09a5dbfaf26cdd9eb80a18225455f08190ec77b05c9eb6cb8af91e3218f315f3
Instruction ID: 3fc00c6fc52a728de31938c0498c30386efac569b70df6b52eb873fd2b3bfcf5
Opcode Fuzzy Hash: 09a5dbfaf26cdd9eb80a18225455f08190ec77b05c9eb6cb8af91e3218f315f3
Instruction Fuzzy Hash: 29813F3660CB8196EB208F69E5547AABBA4FB49394F440235DB8D87F68DF7CD184CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0551B18 Relevance: 15.1, APIs: 10, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6B0551B27

Part of subcall function 00007FF6B0551E58: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF6B0551E7A

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6B0551B3C
__scrt_release_startup_lock.LIBCMT ref: 00007FF6B0551BAA
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6B0551BC0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF6B0551BEC
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6B0551BFD
__scrt_is_managed_app.LIBCMT ref: 00007FF6B0551C20
__scrt_uninitialize_crt.LIBCMT ref: 00007FF6B0551C37
__scrt_fastfail.LIBCMT ref: 00007FF6B0551C69
__scrt_fastfail.LIBCMT ref: 00007FF6B0551C74

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 1664584033-0
Opcode ID: 5a7faafd83a74ff8ffc41cf50628bb0aad924412064540e899df9bcfd8de565b
Instruction ID: d41112e93e0160478c0ac4d41f17e7a31446cf53e8edc0005c820620d5e601a8
Opcode Fuzzy Hash: 5a7faafd83a74ff8ffc41cf50628bb0aad924412064540e899df9bcfd8de565b
Instruction Fuzzy Hash: C7314C2BE0C207A5FA14A76D96613BD2E919F45784F844434DB0ECBFF7DE2DA8448348

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0555688 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6B0555687), ref: 00007FF6B05556B1
TerminateProcess.KERNEL32(?,?,?,00007FF6B0555687), ref: 00007FF6B05556BC
ExitProcess.KERNEL32 ref: 00007FF6B05556CB

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c4e2dc9b7e11eb9aaa1e69c8b109474d117b6f4814dcc67f3ff29f39d74aea43
Instruction ID: 6cc2ba71ba6caee9ae50c93a67552a23523da468f5b9fb8f7826eb7577a13546
Opcode Fuzzy Hash: c4e2dc9b7e11eb9aaa1e69c8b109474d117b6f4814dcc67f3ff29f39d74aea43
Instruction Fuzzy Hash: DAE04825B0C74552FB5467795AA537D36516F44741F144538CB4EC7772CE3DE444C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B05555CC Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B05555EB

Part of subcall function 00007FF6B05556D4: GetModuleHandleExW.KERNEL32 ref: 00007FF6B05556F0
Part of subcall function 00007FF6B05556D4: GetProcAddress.KERNEL32 ref: 00007FF6B0555706
Part of subcall function 00007FF6B05556D4: FreeLibrary.KERNEL32 ref: 00007FF6B0555723

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: a5385da17ff3ebcf2e3b17a687684422e28ce26f38e708bc7f901617c0ba32e9
Instruction ID: 4cbd579ab50751931d802460fe1470d9e757125a6d6063257da28e7328248f76
Opcode Fuzzy Hash: a5385da17ff3ebcf2e3b17a687684422e28ce26f38e708bc7f901617c0ba32e9
Instruction Fuzzy Hash: 88216836F09B819AEB108F68C5603AC3AB0EB44708F85453AD70C87B85DF78D485CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0559CF4 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B0559D1F

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d2bb7464af729a4be4a44dba36f005038d02a4d764f8f77bb1a7fb8f863c9a45
Instruction ID: 8424a9bb2862180eb97070a5d8ef094c4475b27e5b0809ea14f0d83f9febba4c
Opcode Fuzzy Hash: d2bb7464af729a4be4a44dba36f005038d02a4d764f8f77bb1a7fb8f863c9a45
Instruction Fuzzy Hash: EA113D3B91C682A6F720AB1CA6402796AB4EB80780F554535D75D87FA6DF3CE8108B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B05588FC Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6B05575D1,?,?,?,00007FF6B055693D,?,?,?,?,00007FF6B05557D4), ref: 00007FF6B0558951

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 35c93f3c64bc04b3f1fe4ce5a1a65dff6d95e55c0600028538337e8b9ce1f872
Instruction ID: 079916b74f0be073ae9ef5505027753a79eb94ffe8fcf017b76293c91393aa30
Opcode Fuzzy Hash: 35c93f3c64bc04b3f1fe4ce5a1a65dff6d95e55c0600028538337e8b9ce1f872
Instruction Fuzzy Hash: E5F0CD5BB0D20360FE6457AE8B113F82AA02F88B80F0C0434CB0ED6FD2DD2DE4848211

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6B055C17C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1207COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6B055C1C5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B055C7D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B055C993
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B055CB9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B055CE5E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B055D059
memcpy_s.LIBCPMT ref: 00007FF6B055D147
memcpy_s.LIBCPMT ref: 00007FF6B055D1F2
memcpy_s.LIBCPMT ref: 00007FF6B055D2BB

Strings

1#QNAN, xrefs: 00007FF6B055D373
1#IND, xrefs: 00007FF6B055D361
1#SNAN, xrefs: 00007FF6B055D36A
1#INF, xrefs: 00007FF6B055D38F

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: b550c01877cce58f3d5e3e6964ea04c067201ece84c37d388ad1dcbe12cb6042
Instruction ID: beaa52e0a9009bcab367266e1c1a603e1cd2c3669e0d952b9941bb37a447da3f
Opcode Fuzzy Hash: b550c01877cce58f3d5e3e6964ea04c067201ece84c37d388ad1dcbe12cb6042
Instruction Fuzzy Hash: 1FB2A1BBA1C2829EE7658E6DD6407F92FA1FB44788F505135DB0A97F84DF38A940CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0558988 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B05589D1

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e3a581d8e46b80029fb9a2fa56736852ee1f2e022ff00931e9c1985116f6a039
Instruction ID: 769ce19c62457b8aa1b314de02fc0f3dcd9f68d0a8b42bfd51115176cbfc9497
Opcode Fuzzy Hash: e3a581d8e46b80029fb9a2fa56736852ee1f2e022ff00931e9c1985116f6a039
Instruction Fuzzy Hash: E9A1C367B1D68191EA60CB2A96002FA6BA0FB44BE4F444536EF5E97FD4DF3CE4458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B05563A0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6B0556419
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B0556431
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B055646C
IsDebuggerPresent.KERNEL32 ref: 00007FF6B05564A5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B05564AF
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B05564BA

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 402b09af9edbf346ca551e622a0080c31ee747c03ef40c80db943752cf5856cb
Instruction ID: a9b14008a3f87b2beb2bd860f9c7ad40357a50247e891f2c8747e0e1b39bc263
Opcode Fuzzy Hash: 402b09af9edbf346ca551e622a0080c31ee747c03ef40c80db943752cf5856cb
Instruction Fuzzy Hash: 5C315C37618B8196DB608B29E9803AE7BA4FB89794F540135EB9D83BA5DF38C145CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055DC5C Relevance: 7.8, APIs: 5, Instructions: 325fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF6B055DCCB
WriteFile.KERNEL32 ref: 00007FF6B055DF7A
WriteFile.KERNEL32 ref: 00007FF6B055DFCC
GetLastError.KERNEL32 ref: 00007FF6B055E113
GetLastError.KERNEL32 ref: 00007FF6B055E125

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: a0c48ebf1bb9b268af23baad0b1a42c1a50667dbfeb126827b399f1caca8d3ab
Instruction ID: 57b7e6d4ddf4f117e1320408d38de649297fb77a0ad5db1720c43bc3d47d5547
Opcode Fuzzy Hash: a0c48ebf1bb9b268af23baad0b1a42c1a50667dbfeb126827b399f1caca8d3ab
Instruction Fuzzy Hash: 09E1DF77B0CA81AAE714CB68D6442ED7BB1FB44798B540136CB8E87F99DE38E056C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0557708 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B055776C

Strings

gfffffff, xrefs: 00007FF6B0557A09

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: e2bbc7d6315dcd47d367a06b7bbfb15a049f77282ba102e80a4de1ae60e43378
Instruction ID: 15981dac985a87a38c8015f18fdba3368a170a68ad29a060b726fe6848a6428c
Opcode Fuzzy Hash: e2bbc7d6315dcd47d367a06b7bbfb15a049f77282ba102e80a4de1ae60e43378
Instruction Fuzzy Hash: BD91166BB0D6C996EB11CB29E1047BD6BA9AB54B80F05C031CB5D87B91EE3DE506C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055BD50 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6B055BDB6
memcpy_s.LIBCPMT ref: 00007FF6B055BDE1

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4ea583caa57715286bcbaff0c0c248d65fdcd68c244adb70adfc071040c02cb8
Instruction ID: d611eb597cc3e38aa057242e2c4a6f5128895840ee62b93874fd8579b9c229e4
Opcode Fuzzy Hash: 4ea583caa57715286bcbaff0c0c248d65fdcd68c244adb70adfc071040c02cb8
Instruction Fuzzy Hash: E7C1A177A1C6869BE724CF19E64876ABB91FB84784F448135DB4A83B84DF3DE841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055FE48 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6B0560097
RaiseException.KERNEL32 ref: 00007FF6B05600A8

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 3016e5c902860fd6bb847925bff36bb10a0e5324808f9a26888d497749d3215d
Instruction ID: 3a9940cb49810272a80349f756774b39940b702429886362536a4823c0a52cb8
Opcode Fuzzy Hash: 3016e5c902860fd6bb847925bff36bb10a0e5324808f9a26888d497749d3215d
Instruction Fuzzy Hash: 78B16A77604B858BEB55CF2DC9863683BA0F784B88F148922DB5D83BA4CF39D851C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B05541E0 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF6B0554379

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: dcd0c2c0282ee3da9c195a7fe8e7928cebb520d42cd6d83034e0b2cbaaefc648
Instruction ID: e88b240e2441178fe695bd8dbe54170ee64bdf9f6b814acdf99e522bdb21b1de
Opcode Fuzzy Hash: dcd0c2c0282ee3da9c195a7fe8e7928cebb520d42cd6d83034e0b2cbaaefc648
Instruction Fuzzy Hash: 6F61F62FA0C25266FA688A2D52023BE5F91AB4274CF441531EF49D7F99CE2DF8478F05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055ADEC Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6B055ADF0

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b266ade7abc58fac76d1039f40240f4b22a1fc5616c4e4a7c79d11253ef2196f
Instruction ID: ab873331aaf7ed3285bdd4e84cb1f6156c13d341a0da9db5935b39ddc07c7e49
Opcode Fuzzy Hash: b266ade7abc58fac76d1039f40240f4b22a1fc5616c4e4a7c79d11253ef2196f
Instruction Fuzzy Hash: A9B09221E0FA42D2EA482B19AE862282AA47F48750F984039C20CC2720DE2C24E54700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B05559B8 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1b53f613ba489f45d47d26a3481dbb03858e724d308116d12554827087c06a80
Instruction ID: 5b9ecaddbe16814b8f132773cc3759b0083c6dc011ca80db9b251aead3e63a12
Opcode Fuzzy Hash: 1b53f613ba489f45d47d26a3481dbb03858e724d308116d12554827087c06a80
Instruction Fuzzy Hash: E041E227718A5496EF04CF6ADA64269BBA1BB48FE4B099132DF4DC7F58EE3CD0458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055F970 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b7c54b43f600f29056c8ef5a348bf2a13cc2d619325a53f76f35e7c0c32b32
Instruction ID: cfb99ea2a2d9030445e548c44b3ceb98c0b4d56e590704fb7eebf9f4b23d8293
Opcode Fuzzy Hash: d4b7c54b43f600f29056c8ef5a348bf2a13cc2d619325a53f76f35e7c0c32b32
Instruction Fuzzy Hash: B8F0EC72A596959AEBA48F2CA9436397BA0F7483C4F908139D69DC2F14DE3C94618F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B05523D4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a7b5f126a6dac3373390c747dea908d47bd7a66998aee05e1c11b553d4ae1a
Instruction ID: a2322cbe10affbbbc90c9dbc75022bb664bd49374d16bf6b45d68ccb4f4d8e72
Opcode Fuzzy Hash: d3a7b5f126a6dac3373390c747dea908d47bd7a66998aee05e1c11b553d4ae1a
Instruction Fuzzy Hash: 24A0012690C906A0E6088B18AAA01702B20AB56340B860436C30DC1A609E3DA505C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0557FA0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B055810E

Strings

inf, xrefs: 00007FF6B0558027
NAN, xrefs: 00007FF6B0557FFE
nan, xrefs: 00007FF6B0558005
INF, xrefs: 00007FF6B0558014
NAN(SNAN), xrefs: 00007FF6B0558036
NAN(IND), xrefs: 00007FF6B055804C
nan(ind), xrefs: 00007FF6B0558066
nan(snan), xrefs: 00007FF6B0558041

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 3237609d159ab10ba46c234358a695c2e54ff65d7a14f5c5a90dc946218dc2a7
Instruction ID: 1f5769a94b65ea24d85a40791b3223116a7d578966b181c97906a941e471dadc
Opcode Fuzzy Hash: 3237609d159ab10ba46c234358a695c2e54ff65d7a14f5c5a90dc946218dc2a7
Instruction Fuzzy Hash: DB418937B09B85A9E700CF29E9503AD3BA9EB14794F404636EB9C97B98DE3CD525C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055FCFC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6B055FD2D
GetLastError.KERNEL32 ref: 00007FF6B055FD39
CloseHandle.KERNEL32 ref: 00007FF6B055FD51
CreateFileW.KERNEL32 ref: 00007FF6B055FD7C
WriteConsoleW.KERNEL32 ref: 00007FF6B055FD9B

Strings

CONOUT$, xrefs: 00007FF6B055FD5D

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 0fe5b4f37c695c0b6f3e2a81311337362fccd03361fac54772e26fa38c741f50
Instruction ID: e280caa51b436d7e80549dacd140d16863c57a17f14a89127ae5804aa9ff9810
Opcode Fuzzy Hash: 0fe5b4f37c695c0b6f3e2a81311337362fccd03361fac54772e26fa38c741f50
Instruction Fuzzy Hash: 48118122A1CA4196E7508B5AE9543397BA0FB88BE4F044234EF5DC7FA4CF7CD4448744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B05556D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6B05556F0
GetProcAddress.KERNEL32 ref: 00007FF6B0555706
FreeLibrary.KERNEL32 ref: 00007FF6B0555723

Strings

mscoree.dll, xrefs: 00007FF6B05556E7
CorExitProcess, xrefs: 00007FF6B05556FF

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 020c3e3b8397da258905466786b244da60fa815f70b42cf1ce6b1b270428b315
Instruction ID: 873d7909fbf227eed8b783ca842c0e10771bc3233792cfa28e11630c44958676
Opcode Fuzzy Hash: 020c3e3b8397da258905466786b244da60fa815f70b42cf1ce6b1b270428b315
Instruction Fuzzy Hash: 19F03066B2DA42E1EF544B59E6543782B60EF48794F481435D70FC6B64CE2CE488C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055E5B4 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B055E5F5
GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00007FF6B055E573,00000000,?,?,00007FF6B055B467), ref: 00007FF6B055E6B4
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00007FF6B055E573,00000000,?,?,00007FF6B055B467), ref: 00007FF6B055E734

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: ba599d37922e8b35450661dbd2541b4a2ae53d1d8957be9b2ee07974836a1339
Instruction ID: 50ad712e653c98cc52f4959f5ccd580867a93a1b3244926e9f16953869339f4f
Opcode Fuzzy Hash: ba599d37922e8b35450661dbd2541b4a2ae53d1d8957be9b2ee07974836a1339
Instruction Fuzzy Hash: 3481A12BE2C69269FB589B6996503BD2E60FB48B88F444135DB0F93F91DF3CA481C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055F770 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6B055F798
_set_statfp.LIBCMT ref: 00007FF6B055F7B3
_set_statfp.LIBCMT ref: 00007FF6B055F7CF
_set_statfp.LIBCMT ref: 00007FF6B055F80B

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction ID: 22cac884e29139ddd12a25ae9e5d1b6322bce222a218d88b97b156b1875c6db3
Opcode Fuzzy Hash: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction Fuzzy Hash: AE118F2FE2CA0321F764116CEE563761991AF59374F140634EF6E86FDA9E2CA8824314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0553D44 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B0553D79
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B0553F45

Strings

*, xrefs: 00007FF6B0553E79
, xrefs: 00007FF6B0553ECE

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 5f42d9d014ee1588c64c3ccdc5e5e23c51e44588fa4a3c6a4008550626ce6456
Instruction ID: 8d219ba2750ee65905f409ab17f145e980f852bcab4725ee775e6497ad7458b4
Opcode Fuzzy Hash: 5f42d9d014ee1588c64c3ccdc5e5e23c51e44588fa4a3c6a4008550626ce6456
Instruction Fuzzy Hash: A3614D7B90C682AAE7658E2C825A37C3FE5FB05B48F141135CB4EC6B99CF6CE485C610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0557B54 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B0557B97

Strings

gfff, xrefs: 00007FF6B0557CB9
e+000, xrefs: 00007FF6B0557C3C
-, xrefs: 00007FF6B0557C8E

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$e+000$gfff
API String ID: 3215553584-2620144452
Opcode ID: 7af458d71af61469ff462d0940fb275d492fe203a7865171285d0f7806464871
Instruction ID: 4b46bc438eb594458edaca08f0c9ed9926514033fc5354ec82d17815a2ed37f2
Opcode Fuzzy Hash: 7af458d71af61469ff462d0940fb275d492fe203a7865171285d0f7806464871
Instruction Fuzzy Hash: 52510367B1C6CA96E7258F29AA413696E95EB41B90F48D231CB9C87FD5DE2CE440C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B0555010 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B0555042

Part of subcall function 00007FF6B0556954: HeapFree.KERNEL32(?,?,?,00007FF6B055A0D4,?,?,?,00007FF6B055A117,?,?,?,00007FF6B055A640,?,?,?,00007FF6B055A573), ref: 00007FF6B055696A
Part of subcall function 00007FF6B0556954: GetLastError.KERNEL32(?,?,?,00007FF6B055A0D4,?,?,?,00007FF6B055A117,?,?,?,00007FF6B055A640,?,?,?,00007FF6B055A573), ref: 00007FF6B055697C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6B0551A8A), ref: 00007FF6B0555060

Strings

C:\Program Files (x86)\PairVPN\pvextra.exe, xrefs: 00007FF6B055504E

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Program Files (x86)\PairVPN\pvextra.exe
API String ID: 3580290477-4152167777
Opcode ID: 829086d5f288950163d6e815c60d8609ef9d20e9991c2d6761801bd4b349b457
Instruction ID: fe983174c9e7f5c2d9a71616804a52b3366bf978e29077f802898de86769f869
Opcode Fuzzy Hash: 829086d5f288950163d6e815c60d8609ef9d20e9991c2d6761801bd4b349b457
Instruction Fuzzy Hash: 69415B3BA0CA42AAEB55DF299A512BD6FA4EF44BC4B444035EB4E83F95DF3DE441C240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055E358 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6B055E46F
GetLastError.KERNEL32 ref: 00007FF6B055E491

Strings

U, xrefs: 00007FF6B055E41B

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: d76e9eb8e4cb4d33fc0e7d841fb88eff722859b8b9ef7c3f9c56f83c400f3ac2
Instruction ID: 660766dfdd47d80fe78c7fb1521862b78b4d56372f8bebb988b38bb446e55984
Opcode Fuzzy Hash: d76e9eb8e4cb4d33fc0e7d841fb88eff722859b8b9ef7c3f9c56f83c400f3ac2
Instruction Fuzzy Hash: CF418263A1CA8192DB208F29E5443BA6B61FB94794F954131EF4EC7B98EF3CD441C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055ABB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6B055ABE9
LCMapStringW.KERNEL32 ref: 00007FF6B055AC71

Strings

LCMapStringEx, xrefs: 00007FF6B055ABCC, 00007FF6B055ABDD

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 638d72dc1494de3329927df1e099a8a615afebceb2dcaae9a00e6920830c51c6
Instruction ID: 06ed29faa2ec1897d3ba50fdb5516b0d1769e4904412a6ed71597f44ca596c39
Opcode Fuzzy Hash: 638d72dc1494de3329927df1e099a8a615afebceb2dcaae9a00e6920830c51c6
Instruction Fuzzy Hash: E311F936A0CB8196D7608B1AF5402AABBA4FB89B90F544136EF8D83F19CF3CD5448B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055AB4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6B055AB7D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,00007FF6B055843D), ref: 00007FF6B055AB97

Strings

InitializeCriticalSectionEx, xrefs: 00007FF6B055AB5E, 00007FF6B055AB71

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 3a28449e5091563fde798cd67d43612959404555a26bea36366b14b03b30ea30
Instruction ID: 8a87a21680b56ecc1f8595d5ee42a95578644b741aaa20776bee3801b15b4e94
Opcode Fuzzy Hash: 3a28449e5091563fde798cd67d43612959404555a26bea36366b14b03b30ea30
Instruction Fuzzy Hash: F0F0BE2BB0C781B1EB148B4DE2000B82A61BF48B90F484032DB1E83F24CE3CD485C394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055AAF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6B055AB21
TlsSetValue.KERNEL32(?,?,?,00007FF6B05575BE,?,?,?,00007FF6B055693D,?,?,?,?,00007FF6B05557D4), ref: 00007FF6B055AB38

Strings

FlsSetValue, xrefs: 00007FF6B055AB05, 00007FF6B055AB0E

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 06aa6bbb2d3b826af3bd25507ce4197e01d196bcdc1a01ed42ab7ec79a7663f7
Instruction ID: da4aa1d0dd8f8cb3b0bc09a6f69e05406ad36d89ab67ad4a238b39126d07cfd0
Opcode Fuzzy Hash: 06aa6bbb2d3b826af3bd25507ce4197e01d196bcdc1a01ed42ab7ec79a7663f7
Instruction Fuzzy Hash: BAE06D77A0C642B1EB045F5DEA011B92A62BF48790F884077DB5E86BA4CE3CE885C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B055AC8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6B055ACB5
__crtDownlevelLocaleNameToLCID.LIBCPMT ref: 00007FF6B055ACCC

Strings

LocaleNameToLCID, xrefs: 00007FF6B055AC98, 00007FF6B055ACA2

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: DownlevelLocaleName__crttry_get_function
String ID: LocaleNameToLCID
API String ID: 404522899-2050040251
Opcode ID: 797307345ba7f005f64fd82550ab31a90b4a6bd62e563c7f112acd02ccc99a47
Instruction ID: 9490bef5991761d8861ed192e11452ded1b04af649e8fc6ceb77c4c0337e307d
Opcode Fuzzy Hash: 797307345ba7f005f64fd82550ab31a90b4a6bd62e563c7f112acd02ccc99a47
Instruction Fuzzy Hash: 72E09237B1C682B2FB149B5CE6401F92B61AF88790F585032E71D46F61CE3CE885D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B05530D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6B05530FD
TlsSetValue.KERNEL32(?,?,?,00007FF6B0552D9D,?,?,?,?,00007FF6B0552A68,?,?,?,?,00007FF6B0551E7F), ref: 00007FF6B0553114

Strings

FlsSetValue, xrefs: 00007FF6B05530E1, 00007FF6B05530EA

Memory Dump Source

Source File: 00000003.00000002.2276211450.00007FF6B0551000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6B0550000, based on PE: true

Associated: 00000003.00000002.2276184090.00007FF6B0550000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276244831.00007FF6B0561000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276275800.00007FF6B056B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2276300645.00007FF6B056D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff6b0550000_pvextra.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: feb758a2245b8b23874f5e766c6fb482d8e997023c06ae54dbe5c1f330d4ec5e
Instruction ID: 175f179ba2afb43249c140a681f7eee3073bfb7e4be379a04653a7963e36982e
Opcode Fuzzy Hash: feb758a2245b8b23874f5e766c6fb482d8e997023c06ae54dbe5c1f330d4ec5e
Instruction Fuzzy Hash: 9CE06D67E0CA02A1EF045B6AF6011B43A61AF48BD1F4C5032DB1E87B64CE3CE884C314

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\PairVPN\PairVPN.exe (copy)

C:\Program Files (x86)\PairVPN\is-2PSH3.tmp

C:\Program Files (x86)\PairVPN\is-7A3OK.tmp

C:\Program Files (x86)\PairVPN\is-A2FHO.tmp

C:\Program Files (x86)\PairVPN\is-GAJBA.tmp

C:\Program Files (x86)\PairVPN\pveth\is-4G4HM.tmp

C:\Program Files (x86)\PairVPN\pveth\is-5S3BL.tmp

C:\Program Files (x86)\PairVPN\pveth\is-UADM2.tmp

C:\Program Files (x86)\PairVPN\pveth\pveth.cat (copy)

C:\Program Files (x86)\PairVPN\pveth\pveth.inf (copy)

C:\Program Files (x86)\PairVPN\pveth\pveth.sys (copy)

C:\Program Files (x86)\PairVPN\pvextra.exe (copy)

C:\Program Files (x86)\PairVPN\unins000.exe (copy)

C:\Users\user\AppData\Local\Temp\is-83J31.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.tmp

C:\Users\user\AppData\Local\Temp\is-J5BNJ.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39C6.tmp

C:\Users\user\AppData\Local\Temp\{c8205cf6-48e0-7848-82c9-7c315d28ffc2}\SET39D7.tmp

Windows Analysis Report
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre