Edit tour

Windows Analysis Report
InstallGenoPro.exe

Overview

General Information

Sample name:	InstallGenoPro.exe
Analysis ID:	1432329
MD5:	2987bd6b22de138654669d51d8ff98fb
SHA1:	27f3db825b733900d0f6acf86dc1d76106fb5d0a
SHA256:	b6a9cde512965a0084a363ab488d0532f9059d3c94d4f1b354f5536098c4ccf0
Infos:

Detection

Score:	12
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Compliance

Score:	48
Range:	0 - 100

Signatures

Potential malicious VBS script found (has network functionality)

Contains functionality to dynamically determine API calls

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

InstallGenoPro.exe (PID: 6356 cmdline: "C:\Users\user\Desktop\InstallGenoPro.exe" MD5: 2987BD6B22DE138654669D51D8FF98FB)

GenoPro.exe (PID: 7416 cmdline: "C:\Program Files (x86)\GenoPro\GenoPro.exe" MD5: 2659D8A1855E46893FACCA751702C758)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: InstallGenoPro.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\InstallGenoPro.exe

Window detected: Congratulations! You are about to install the world's most powerful tool for creating family trees and genograms. GenoPro is intuitive easy to use and able to construct the most complex genealogy trees.v 3.1.0.1&License AgreementPlease read carefully the License Agreement before installing GenoProNotice to User: This End User License Agreement ("Software License Agreement") is a legal document between you and GenoPro regarding the use of GenoPro software ("the software") documentation and any other accompanying product files. By clicking the "I accept" and "Install" buttons below or by installing or otherwise using the Software you agree to be bound by the terms of this Software License Agreement as well as the GenoPro Privacy Policy ("Privacy Policy") including without limitation the warranty disclaimers limitation of liability data use and termination provisions below whether or not you decide to purchase the Software. You agree that this agreement is enforceable like any written agreement negotiated and signed by you. If you do not agree you are not licensed to use the Software and you must destroy any downloaded copies of the Software in your possession or control. Please go to our Web site at http://www.genopro.com/eula/ to download and print a copy of this Software License Agreement for your files and http://www.genopro.com/privacy/ to review the privacy policy.1. SOFTWARE LICENSE(a) License Grant. Upon your acceptance of this Software License Agreement GenoPro grants you a non-exclusive non-transferable (except as provided below) limited license to install and use a copy of the Software on your compatible computer up to the Permitted Number of computers. The Permitted Number of computers shall be delineated at such time as you elect to purchase the Software. During the evaluation period hereinafter defined only you may install and use the software on one desktop computer and an additional copy of the Software on a second portable notebook computer but only for the exclusive use of the primary user of the first copy of the Software and not for concurrent use. (b) Server Use. You may install one copy of the Software on your computer file server for the purpose of downloading and installing the Software onto other computers within your internal network up to the Permitted Number of computers. (c) Registration Key Upgrades and Updates. Prior to your purchase and as part of the registration for the thirty (30) - day evaluation period as applicable you will receive an evaluation key code. You will receive a purchase key code when you elect to purchase the Software. The purchase key code will enable you to activate the Software beyond the initial evaluation period. You may not re-license reproduce or distribute any key code except with the express written permission of GenoPro. If the Software that you have licensed is an upgrade or an update then the update replaces all or part of the Software previously licensed. The update or upgrade and the

Source: C:\Users\user\Desktop\InstallGenoPro.exe	File created: C:\Users\user\AppData\Roaming\GenoPro\Skins\Narrative Common\Eula.txt			Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	File created: C:\Users\user\AppData\Roaming\GenoPro\Skins\readme.txt			Jump to behavior

Source:	Binary string: d:\dvt\C & CPP\crypto\fciv\Release\fciv.pdbP source: fciv.exe.0.dr
Source:	Binary string: c:\src\Misc\junction\Release\junction.pdb source: junction.exe.0.dr
Source:	Binary string: d:\dvt\C & CPP\crypto\fciv\Release\fciv.pdb source: fciv.exe.0.dr

Source: C:\Users\user\Desktop\InstallGenoPro.exe	Dropped file: oBinaryStream.Write oHttp.ResponseBody			Jump to dropped file
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Dropped file: oBinaryStream.SaveToFile localpath, 2			Jump to dropped file

Source: C:\Users\user\Desktop\InstallGenoPro.exe	Code function: 0_2_00404DF0	0_2_00404DF0
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Code function: 0_2_00405090	0_2_00405090
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Code function: 0_2_00402BB0	0_2_00402BB0

Source: GenoPro.exe.0.dr	Static PE information: Resource name: RT_DIALOG type: GLS_BINARY_LSB_FIRST
Source: GenoPro.exe.0.dr	Static PE information: Resource name: RT_DIALOG type: GLS_BINARY_LSB_FIRST
Source: GenoPro.exe.0.dr	Static PE information: Resource name: RT_DIALOG type: GLS_BINARY_LSB_FIRST
Source: GenoPro.exe.0.dr	Static PE information: Resource name: RT_DIALOG type: GLS_BINARY_LSB_FIRST

Source: InstallGenoPro.exe	String found in binary or memory: /install
Source: InstallGenoPro.exe	String found in binary or memory: /install
Source: InstallGenoPro.exe	String found in binary or memory: A shortcut to the Start menu %shas been created.and to your desktop /install"%s"Software\Classes\.gnoGenoPro.DocumentGenoPro 3.1.0.1GenoPro.exeUninstall.exeCreating shortcut.../%s %sv 3.1.0.1Please select the folder you want to install GenoProHiddenNDCUUSilentUPathDefaultPathURLInfoAbouthttp://www.genopro.com/Publisherwww.genopro.comDisplayIconDisplayNameUninstallStringPowerful graphical editor capable to create the most complex family tree%dSkinsPath.SkinsSoftware\DanMorin.com\GenoPro\ReportGenerator\C:\Program FilesProgramFilesDirSoftware\DanMorin.com\GenoPro\SettingsLicenseAgreement.DEFAULT\Software\GenoPro.comSoftware\GenoPro.com1.2.3too many length or distance symbolsincorrect length checkincorrect data checkinvalid distance too far backinvalid distance codeinvalid literal/length codeinvalid distances setinvalid literal/lengths setinvalid bit length repeatinvalid code lengths setinvalid stored block lengthsinvalid block typeheader crc mismatchunknown header flags setincorrect header checkinvalid window sizeunknown compression methodincompatible versionbuffer errorinsufficient memorydata errorstream errorfile errorstream endneed dictionary

Source: unknown	Process created: C:\Users\user\Desktop\InstallGenoPro.exe "C:\Users\user\Desktop\InstallGenoPro.exe"
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Process created: C:\Program Files (x86)\GenoPro\GenoPro.exe "C:\Program Files (x86)\GenoPro\GenoPro.exe"
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Process created: C:\Program Files (x86)\GenoPro\GenoPro.exe "C:\Program Files (x86)\GenoPro\GenoPro.exe"	Jump to behavior

Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Section loaded: sxs.dll	Jump to behavior

Source: GenoPro.lnk.0.dr	LNK file: ..\..\..\Program Files (x86)\GenoPro\GenoPro.exe
Source: GenoPro.lnk0.0.dr	LNK file: ..\..\..\..\..\Program Files (x86)\GenoPro\GenoPro.exe

Source: C:\Users\user\Desktop\InstallGenoPro.exe	Automated click: I accept the agreement
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Automated click: Install
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: OK
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Automated click: Next >

Source: C:\Users\user\Desktop\InstallGenoPro.exe	Window detected: Number of UI elements: 11
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Window detected: Number of UI elements: 11
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Window detected: Number of UI elements: 11

Source: C:\Users\user\Desktop\InstallGenoPro.exe	File created: C:\Program Files (x86)\GenoPro\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\InstallGenoPro.exe	File created: C:\Users\user\AppData\Roaming\GenoPro\Skins\Narrative Common\Code\fciv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\InstallGenoPro.exe	File created: C:\Users\user\AppData\Roaming\GenoPro\Skins\Narrative Common\junction.exe	Jump to dropped file
Source: C:\Users\user\Desktop\InstallGenoPro.exe	File created: C:\Program Files (x86)\GenoPro\GenoPro.exe	Jump to dropped file

Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GenoPro\GenoPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\InstallGenoPro.exe	Dropped PE file which has not been started: C:\Program Files (x86)\GenoPro\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GenoPro\Skins\Narrative Common\Code\fciv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GenoPro\Skins\Narrative Common\junction.exe	Jump to dropped file

Source: C:\Users\user\Desktop\InstallGenoPro.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\InstallGenoPro.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Command and Scripting Interpreter	1 Scripting	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Source	Detection	Scanner
C:\Program Files (x86)\GenoPro\GenoPro.exe	2%	ReversingLabs
C:\Program Files (x86)\GenoPro\Uninstall.exe	2%	ReversingLabs
C:\Users\user\AppData\Roaming\GenoPro\Skins\Narrative Common\Code\fciv.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GenoPro\Skins\Narrative Common\junction.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://YOUR_SERVER/javascripts/timeline/timeline_ajax/simile-ajax-api.js	0%	Avira URL Cloud	safe
ftp://ftp.MyServer.com/MyAncestry	0%	Avira URL Cloud	safe
https://www.genopro.com0	0%	Avira URL Cloud	safe
http://www.MyServer.com/My#Ancestry&Relatives	0%	Avira URL Cloud	safe
http://www.MyServer.com/My#Ancestry&Relatives	0%	Avira URL Cloud	safe
http://calendar.pikesys.com	0%	Avira URL Cloud	safe
ftp://ftp.MyServer.com/MyAncestry/GenoProCache.xml	0%	Avira URL Cloud	safe
http://www.szerver.hu/kepek/kep1.jpg"	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
ftp://ftp.MyServer.com/MyAncestry	GenoPro.exe, 00000002.00000002.2962941538.0000000003472000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://familytrees.genopro.com/Harry-Potter/pictures/Phineas-Nigellus-Black.jpg	Data.xml	false		high
http://support.genopro.com/Topic33937.aspx	history.rtf3.0.dr	false		high
http://www.genopro.com/help/report-generator/allow-blocked-content/">Au	Dictionary.xml6.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Grey-Lady.jpg	Data.xml	false		high
https://www.genopro.com/academic/	GenoPro.exe, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Susan-Bones.jpg	Data.xml	false		high
http://wkhtmltopdf.org	ConfigMsgLocal.xml0.0.dr	false		high
http://familytrees.genopro.com/	heading.htm.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Fat-Friar.jpg	Data.xml	false		high
http://YOUR_SERVER/javascripts/timeline/timeline_ajax/simile-ajax-api.js	timeline-api.js.0.dr	false	Avira URL Cloud: safe	low
http://familytrees.genopro.com/Harry-Potter/pictures/Fleur-Delacour2.jpg	Data.xml	false		high
http://www.opensource.org/licenses/mit-license.php	jquery.cookie.js1.0.dr, jquery.fancybox-1.3.4.css.0.dr, jquery.fancybox-1.2.5.js.0.dr, jquery.fancybox-1.2.5.pack.js.0.dr, jquery.fancybox-1.3.4.pack.js.0.dr	false		high
http://www.genopro.com/registration	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Argus-Filtch.jpg	Data.xml	false		high
https://familytrees.genopro.com/	GenoPro.exe, 00000002.00000002.2961759771.0000000000585000.00000002.00000001.01000000.00000005.sdmp	false		high
http://simile.mit.edu/ajax/api/simile-ajax-api.js	simile-ajax-api.js0.0.dr	false		high
https://www.genopro.com/GenoProX/crowdfunding/	GenoPro.exe, 00000002.00000002.2961617988.0000000000565000.00000008.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Draco-Crabbe-Goyle-Pansy.jpg	Data.xml	false		high
http://www.macromedia.com/go/getflashplayer">	InstallGenoPro.exe, 00000000.00000002.1925434309.0000000003000000.00000004.00000020.00020000.00000000.sdmp, Dictionary.xml2.0.dr, Dictionary.xml13.0.dr, Dictionary.xml1.0.dr, Dictionary.xml26.0.dr, Dictionary.xml6.0.dr, Dictionary.xml30.0.dr, Dictionary.xml9.0.dr, Dictionary.xml23.0.dr	false		high
https://www.genopro.com0	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000002.2963134823.0000000004610000.00000002.00000001.00040000.00000005.sdmp, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961759771.0000000000585000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.genopro.com/	GenoPro.exe, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961759771.0000000000585000.00000002.00000001.01000000.00000005.sdmp	false		high
https://familytrees.genopro.com/#W/#W	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884684100.0000000000557000.00000008.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961617988.0000000000565000.00000008.00000001.01000000.00000005.sdmp	false		high
http://www.genopro.com/genogram/'	Dictionary.xml23.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Arthur-Weasley.jpg	Data.xml	false		high
http://familytrees.genopro.com	Config.xml5.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Fred-and-George-Weasley.jpg	Data.xml	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Uncle-Vernon2.jpg	Data.xml	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Alastor-Moody.jpg	Data.xml	false		high
http://www.genopro.com/'>GenoPro	Dictionary.xml2.0.dr, Dictionary.xml30.0.dr, Dictionary.xml23.0.dr	false		high
https://www.genopro.com/buy/TotalDiscountUpgradeDiscountVolumeDiscountVersionKeyOldEmailsPurchase	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884684100.0000000000557000.00000008.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961617988.0000000000565000.00000008.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Crookshanks.jpg	Data.xml	false		high
http://www.symauth.com/cps0(	InstallGenoPro.exe	false		high
http://maps.google.com/maps/api/js?key=	family_map.htm.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Harry-Potter5.jpg	Data.xml	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Parvati-Patil.jpg	Data.xml	false		high
http://www.genopro.com/'>	Dictionary.xml13.0.dr	false		high
http://www.MyServer.com/My#Ancestry&Relatives	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	InstallGenoPro.exe	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Gregory-Goyle.jpg	Data.xml	false		high
http://www.genopro.com/ssl	GenoPro.exe, 00000002.00000002.2962941538.0000000003472000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.genopro.com/registration/	GenoPro.exe, 00000002.00000002.2962941538.0000000003517000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000002.2961594898.0000000000563000.00000004.00000001.01000000.00000005.sdmp	false		high
http://www.genopro.com/'>GenoPro</a>	Dictionary.xml9.0.dr	false		high
http://static.simile.mit.edu/ajax/api-2.2.0/simile-ajax-api.js	timeline-api.js.0.dr	false		high
https://www.genopro.com/registration/Online	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884684100.0000000000557000.00000008.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961594898.0000000000563000.00000004.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Fred-and-George-Weasley2.jpg	Data.xml	false		high
http://www.genopro.com/beta/archives/The	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884684100.0000000000557000.00000008.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961548139.000000000055A000.00000004.00000001.01000000.00000005.sdmp	false		high
https://www.genopro.com/2020-upgrade/	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884684100.0000000000557000.00000008.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961594898.0000000000563000.00000004.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Cho-Chang.jpg	Data.xml	false		high
https://www.genopro.com/help/upgrade/incorrect-file-version/	GenoPro.exe, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961759771.0000000000585000.00000002.00000001.01000000.00000005.sdmp	false		high
https://www.genopro.com/registration/account-recovery/	GenoPro.exe, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://www.genopro.com/">GenoPro</a><sup>®</sup>	Dictionary.xml13.0.dr, Dictionary.xml1.0.dr, Dictionary.xml26.0.dr, Dictionary.xml30.0.dr, Dictionary.xml9.0.dr, Dictionary.xml23.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Draco-Malfoy2.jpg	Data.xml	false		high
http://support.genopro.com/Topic31953.aspx	history.rtf3.0.dr	false		high
https://familytrees.genopro.com/#W/#Whttp://www.#W/#Wwww.ftp.http://support.genopro.com/Logon.aspx?P	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884684100.0000000000557000.00000008.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961617988.0000000000565000.00000008.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Angelina.jpg	Data.xml	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Pomona-Sprout.jpg	Data.xml	false		high
https://www.genopro.com/help/upgrade/possible-data-loss/	GenoPro.exe, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961759771.0000000000585000.00000002.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Minerva-McGonagall2.jpg	Data.xml	false		high
https://www.genopro.com/registration/cancel/	GenoPro.exe, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Gilderoy-Lockhart.jpg	Data.xml	false		high
http://vjs.zencdn.net/4.12/video-js.css	source.htm.0.dr	false		high
https://www.genopro.com/buy/D	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961814282.00000000005D0000.00000004.00000001.01000000.00000005.sdmp	false		high
http://www.szerver.hu/kepek/kep1.jpg"	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://support.genopro.com/Topic38774.aspx	Dictionary.xml30.0.dr	false		high
http://www.genopro.com/InstallGenoPro.exe	GenoPro.exe, 00000002.00000002.2962941538.0000000003472000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.genopro.com/">GenoPro</a><sup>	Dictionary.xml6.0.dr	false		high
http://familytrees.genopro.com/genome/HarryPotter	Config.xml24.0.dr, Config.xml2.0.dr, Config.xml12.0.dr	false		high
http://www.genopro.com/NewReportGenerator/Configuration/	Config.xml6.0.dr, ConfigMsgEN.xml2.0.dr, Config.xml32.0.dr, Config.xml35.0.dr	false		high
http://www.server.com/afbeeldingen/afb1.jpg"	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Barty-Crouch.jpg	Data.xml	false		high
http://www.genopro.com/2020-upgrade/	GenoPro.exe, 00000002.00000002.2962941538.0000000003472000.00000004.00000020.00020000.00000000.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Fawkes.jpg	Data.xml	false		high
https://www.genopro.com/privacy/	GenoPro.exe, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://validator.w3.org/about.html	home.htm.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Albus-Dumbledore.jpg	Data.xml	false		high
http://www.genopro.com/registration/	GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Apps/ReformatXML	Dictionary.xml2.0.dr, Dictionary.xml30.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Draco-Malfoy.jpg	Data.xml	false		high
http://www.genopro.com/sdk/Report-Generator/Configuration/	Config.xml5.0.dr, Config.xml24.0.dr, Config.xml2.0.dr, ConfigMsgEN.xml1.0.dr, Config.xml12.0.dr, ConfigMsgNL.xml.0.dr	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Madame-Hooch.jpg	Data.xml	false		high
http://www.genopro.com/ssl.	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://www.MyServer.com/My#Ancestry&Relatives	GenoPro.exe, 00000002.00000002.2962941538.0000000003472000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://calendar.pikesys.com	calendarevents.js.0.dr	false	Avira URL Cloud: safe	unknown
http://familytrees.genopro.com/Harry-Potter/pictures/Aragog.jpg	Data.xml	false		high
http://videojs.com/html5-video-support/"	InstallGenoPro.exe, 00000000.00000002.1925434309.0000000003000000.00000004.00000020.00020000.00000000.sdmp, Dictionary.xml2.0.dr, Dictionary.xml13.0.dr, Dictionary.xml30.0.dr, Dictionary.xml23.0.dr	false		high
https://www.genopro.com/sdk/Report-Generator/	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884684100.0000000000557000.00000008.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961617988.0000000000565000.00000008.00000001.01000000.00000005.sdmp	false		high
https://www.genopro.com	GenoPro.exe	false		high
http://www.genopro.com/sdk/report-generator/phrase/D	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000002.2963134823.0000000004610000.00000002.00000001.00040000.00000005.sdmp, GenoPro.exe, 00000002.00000000.1884724434.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000001.1885799485.0000000000585000.00000002.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961759771.0000000000585000.00000002.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Harry-Potter2.jpg	Data.xml	false		high
http://www.genopro.com/registration/.	GenoPro.exe, 00000002.00000002.2961838575.00000000005D1000.00000002.00000001.01000000.00000005.sdmp	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Hedwig.jpg	Data.xml	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Albus-Dumbledore2.jpg	Data.xml	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Dudley-Dursley.jpg	Data.xml	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Uncle-Vernon.jpg	Data.xml	false		high
http://familytrees.genopro.com/Harry-Potter/pictures/Seamus-Finnigan.jpg	Data.xml	false		high
https://www.genopro.com/help/	InstallGenoPro.exe, 00000000.00000003.1759725601.0000000004E17000.00000004.00000020.00020000.00000000.sdmp, GenoPro.exe, 00000002.00000000.1884684100.0000000000557000.00000008.00000001.01000000.00000005.sdmp, GenoPro.exe, 00000002.00000002.2961548139.000000000055A000.00000004.00000001.01000000.00000005.sdmp	false		high
ftp://ftp.MyServer.com/MyAncestry/GenoProCache.xml	GenoPro.exe, 00000002.00000002.2962941538.0000000003472000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://support.genopro.com/Topic32062.aspx	calendarevents.js.0.dr	false		high
http://jquery.com/	jquery.min.js2.0.dr, jquery.min.js.0.dr, jquery.min.js1.0.dr	false		high

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432329
Start date and time:	2024-04-26 21:29:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	InstallGenoPro.exe
Detection:	CLEAN
Classification:	clean12.winEXE@3/1027@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report InstallGenoPro.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\GenoPro\GenoPro.exe

C:\Program Files (x86)\GenoPro\SampleFiles\Dan.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\Harry-Potter4.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\HarryPotter.gno

C:\Program Files (x86)\GenoPro\SampleFiles\Hedwig2.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\Hermione-Granger2.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\Larry.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\Lord-Voldemort.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\MedicalGenogram.gno

C:\Program Files (x86)\GenoPro\SampleFiles\Professor-Snape.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\Rubeus-Hagrid.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\SampleGenogram.gno

C:\Program Files (x86)\GenoPro\SampleFiles\SocialWork.gno

C:\Program Files (x86)\GenoPro\SampleFiles\Sophia.jpg

C:\Program Files (x86)\GenoPro\SampleFiles\Tutorials.gno

C:\Program Files (x86)\GenoPro\SampleFiles\lab-test-result-negative-COVID19.png

C:\Program Files (x86)\GenoPro\SampleFiles\lab-test-result-positive-COVID19.png

C:\Program Files (x86)\GenoPro\SampleFiles\x-ray.jpg

C:\Program Files (x86)\GenoPro\Uninstall.cfg

C:\Program Files (x86)\GenoPro\Uninstall.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GenoPro.lnk

C:\Users\Public\Desktop\GenoPro.lnk

C:\Users\user\AppData\Local\Temp\~DF6B95F39541E5BBA6.TMP

C:\Users\user\AppData\Local\Temp\~DFF77F386CD549EECD.TMP

Windows Analysis Report
InstallGenoPro.exe

Process:	C:\Users\user\Desktop\InstallGenoPro.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9288680
Entropy (8bit):	6.562054675470084
Encrypted:	false
SSDEEP:	98304:ibnzIrW7z9u72pG5PQkcEgiT3UN9qUZSRe6VGnRZqjyG:ibnzI
MD5:	2659D8A1855E46893FACCA751702C758
SHA1:	723634D80D18F5187A96C30FE9B188D07DA29738
SHA-256:	88E38709E54C15BCA474ACBDAC66CB09F36ADCC0709548DFD6AA00BB5713463D
SHA-512:	997C93289D4CC12738374B36168B206771AA7DD702DCAB5663A64495AEB94A50C4DA6908A4C8478C88CF079B037CFC524582D97DFCE996AAD06BDA2B3A4B2F22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T..LT..LT..L/.LV..L...L_..L6..LD..L;..LW..L..LR..L;..L_..L;..LV..Lb.LW..LT..Ls..Lb.LZ..LT..Lh..Lb.L...L...LU..LRichT..L........................PE..L...t\|.^........../......@....\|.............P....@..........................`...............@..............................@.......P....v..........................................................................P...............................text....6.......@.................. ..`.rdata.......P... ...P..............@..@.data........p... ...p..............@....rsrc.....v..P....v.................@..@........................................................................................................................................................................................................................................................................................................................

Entrypoint:	0x405b0c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x5EF682D2 [Fri Jun 26 23:20:50 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	751de7e0699c3742c1d7f1587d60ea7a

Signature Valid:	true
Signature Issuer:	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	20/01/2020 00:00:00 13/11/2020 23:59:59
Subject Chain	CN=GenoPro, O=GenoPro, L=Fraijanes, S=Guatemala, C=GT
Version:	3
Thumbprint MD5:	5BE1BE33A963025FE103D69C9D44CACD
Thumbprint SHA-1:	5B2F96C1CA62384A8DC8031240C0FC1A7E5A6053
Thumbprint SHA-256:	F1FCAE54901E5B05997B8394B39092D708A461CB72F95539373FC716891D6820
Serial:	475E143B9AF346E66D608A636560A261

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd200	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13000	0x5fc1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x60f000	0x1be8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x1b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8d62	0x9000	840133357cd350d59be7a87c034669b9	False	0.6042209201388888	data	6.61880644112876	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa000	0x3b42	0x4000	5bc070390b79a4f4b93ec96fa0ef52aa	False	0.7215576171875	data	6.854381816340213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x495c	0x4000	6b50c492d22df7bd86153b2b338afe95	False	0.1068115234375	Matlab v4 mat-file (little endian) $\215@, numeric, rows 4202754, columns 0	1.514635419152471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x13000	0x5fc1f0	0x5fd000	deed02a595a776e49717aa6508a9db3a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x60b708	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.26016597510373446
RT_ICON	0x60dcb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.23147279549718575
RT_ICON	0x60ed58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.12056737588652482
RT_DIALOG	0x60b090	0x9e	data	English	United States	0.7848101265822784
RT_DIALOG	0x60b130	0x3a2	data	English	United States	0.4806451612903226
RT_DIALOG	0x60b4d8	0x22c	data	English	United States	0.5215827338129496
RT_RCDATA	0x6094d0	0x1852	data	English	United States	1.0017667844522968
RT_RCDATA	0x13270	0x5f6260	data	English	United States	0.9991588592529297
RT_GROUP_ICON	0x60f1c0	0x30	data	English	United States	0.8541666666666666
RT_MANIFEST	0x60ad28	0x363	ASCII text, with CRLF line terminators	English	United States	0.5351787773933102

DLL	Import
KERNEL32.dll	GetProcAddress, LoadLibraryA, Sleep, WriteFile, GetLastError, DeleteFileA, SetFileAttributesA, ReadFile, GetFileSize, CreateFileA, SetFileTime, SizeofResource, WinExec, GetVersion, GetFileAttributesA, CreateDirectoryA, MultiByteToWideChar, LCMapStringW, LCMapStringA, SetStdHandle, GetOEMCP, GetACP, GetCPInfo, GetStringTypeW, GetStringTypeA, OpenProcess, HeapReAlloc, VirtualAlloc, RtlUnwind, VirtualFree, HeapCreate, HeapDestroy, GetVersionExA, GetEnvironmentVariableA, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, WideCharToMultiByte, FreeEnvironmentStringsW, FreeEnvironmentStringsA, GetModuleFileNameA, UnhandledExceptionFilter, HeapFree, HeapAlloc, FlushFileBuffers, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, GetCurrentProcess, CloseHandle, lstrcmpiA, TerminateProcess, FindResourceA, SetFilePointer, LoadResource, ExitProcess
USER32.dll	IsDlgButtonChecked, GetDlgItem, EnableWindow, GetActiveWindow, GetLastActivePopup, MessageBoxA, IsDialogMessageA, TranslateMessage, DispatchMessageA, GetDlgItemTextA, PostQuitMessage, LoadIconA, SendMessageA, SetFocus, CheckDlgButton, CreateDialogParamA, DestroyWindow, SetWindowTextA, DialogBoxParamA, EndDialog, wsprintfA, SetDlgItemTextA, SetTimer, EnumWindows, GetWindowThreadProcessId, IsWindowVisible, SetWindowPos, ShowWindowAsync, PostMessageA, LoadCursorA, SetCursor, ShowWindow, UpdateWindow, GetMessageA
ADVAPI32.dll	RegSetValueExA, RegQueryValueExA, RegCreateKeyExA, RegOpenKeyExA, RegCloseKey
SHELL32.dll	SHGetMalloc, SHBrowseForFolderA, SHGetPathFromIDListA, SHGetSpecialFolderLocation
ole32.dll	CoInitialize, CoCreateInstance

Target ID:	0
Start time:	21:30:22
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\InstallGenoPro.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\InstallGenoPro.exe"
Imagebase:	0x400000
File size:	6'360'040 bytes
MD5 hash:	2987BD6B22DE138654669D51D8FF98FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	21:30:44
Start date:	26/04/2024
Path:	C:\Program Files (x86)\GenoPro\GenoPro.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\GenoPro\GenoPro.exe"
Imagebase:	0x400000
File size:	9'288'680 bytes
MD5 hash:	2659D8A1855E46893FACCA751702C758
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	false

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.3%
Total number of Nodes:	619
Total number of Limit Nodes:	12