Edit tour

Windows Analysis Report
Nondesistance.exe

Overview

General Information

Sample name:	Nondesistance.exe
Analysis ID:	1447915
MD5:	9695b61f42f2e5a77e2e8d29963fe980
SHA1:	92396f929ffc0ec1c2929dcba7fa2b3de5859bc0
SHA256:	1c6b868bda50a13de084c97460436742b1636b75e60708eeecb9c44d574ccce9
Tags:	exe
Infos:

Detection

GuLoader

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

PE / OLE file has an invalid certificate

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Nondesistance.exe (PID: 2316 cmdline: "C:\Users\user\Desktop\Nondesistance.exe" MD5: 9695B61F42F2E5A77E2E8D29963FE980)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4140963673.0000000004D6E000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Nondesistance.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Nondesistance.exe	Virustotal: Detection: 56%			Perma Link
Source: Nondesistance.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 86.9% probability

Source: Nondesistance.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Nondesistance.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_00406033 FindFirstFileA,FindClose,	0_2_00406033
Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055D1
Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: Nondesistance.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Nondesistance.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\Nondesistance.exe

Code function: 0_2_00405086 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405086

Source: C:\Users\user\Desktop\Nondesistance.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Nondesistance.exe

Code function: 0_2_0040310F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040310F

Source: C:\Users\user\Desktop\Nondesistance.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_004048C5	0_2_004048C5
Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_004064CB	0_2_004064CB
Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_00406CA2	0_2_00406CA2

Source: Nondesistance.exe

Static PE information: invalid certificate

Source: Nondesistance.exe, 00000000.00000002.4140250945.0000000000448000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameflinkeste anorectous.exeN vs Nondesistance.exe
Source: Nondesistance.exe	Binary or memory string: OriginalFilenameflinkeste anorectous.exeN vs Nondesistance.exe

Source: Nondesistance.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.troj.evad.winEXE@1/7@0/0

Source: C:\Users\user\Desktop\Nondesistance.exe

0_2_0040310F

Source: C:\Users\user\Desktop\Nondesistance.exe

Code function: 0_2_00404352 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404352

Source: C:\Users\user\Desktop\Nondesistance.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\Nondesistance.exe

File created: C:\Users\user\dewater

Jump to behavior

Source: C:\Users\user\Desktop\Nondesistance.exe

File created: C:\Users\user\AppData\Local\Temp\nsq218E.tmp

Jump to behavior

Source: Nondesistance.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Nondesistance.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Nondesistance.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Nondesistance.exe	Virustotal: Detection: 56%
Source: Nondesistance.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\Nondesistance.exe

File read: C:\Users\user\Desktop\Nondesistance.exe

Jump to behavior

Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\Nondesistance.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: betnksomme.lnk.0.dr

LNK file: ..\AppData\Roaming\immoralizing.tar

Source: C:\Users\user\Desktop\Nondesistance.exe

File written: C:\Users\user\AppData\Local\Temp\Settings.ini

Jump to behavior

Source: Nondesistance.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.4140963673.0000000004D6E000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Nondesistance.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\Nondesistance.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

Source: C:\Users\user\Desktop\Nondesistance.exe

File created: C:\Users\user\AppData\Local\Temp\nsh2633.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Nondesistance.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Nondesistance.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Nondesistance.exe

RDTSC instruction interceptor: First address: 51F2A1A second address: 51F2A1A instructions: 0x00000000 rdtsc 0x00000002 test cx, 31FBh 0x00000007 test dh, ah 0x00000009 cmp ebx, ecx 0x0000000b jc 00007F9BF5004F38h 0x0000000d cmp dh, 0000002Ch 0x00000010 cmp esi, 5FE4F3B3h 0x00000016 inc ebp 0x00000017 cmp ch, bh 0x00000019 inc ebx 0x0000001a rdtsc

Source: C:\Users\user\Desktop\Nondesistance.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsh2633.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_00406033 FindFirstFileA,FindClose,	0_2_00406033
Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055D1
Source: C:\Users\user\Desktop\Nondesistance.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688

Source: C:\Users\user\Desktop\Nondesistance.exe	API call chain: ExitProcess graph end node			graph_0-4186
Source: C:\Users\user\Desktop\Nondesistance.exe	API call chain: ExitProcess graph end node			graph_0-4022

Source: C:\Users\user\Desktop\Nondesistance.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\Nondesistance.exe

Code function: 0_2_00405D51 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Access Token Manipulation	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Nondesistance.exe	57%	Virustotal		Browse
Nondesistance.exe	50%	ReversingLabs	Win32.Trojan.GuLoader
Nondesistance.exe	100%	Avira	HEUR/AGEN.1331786

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsh2633.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsh2633.tmp\System.dll	1%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	Nondesistance.exe	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Nondesistance.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447915
Start date and time:	2024-05-27 12:21:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Nondesistance.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@1/7@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 50 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsh2633.tmp\System.dll	Platosammine.exe	Get hash	malicious	FormBook, GuLoader	Browse
	FRA.0038222.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Platosammine.exe	Get hash	malicious	GuLoader	Browse
	FRA.0038222.exe	Get hash	malicious	GuLoader	Browse
	file.zip	Get hash	malicious	GuLoader	Browse
	Borgerreprsentants.exe	Get hash	malicious	GuLoader	Browse
	Borgerreprsentants.exe	Get hash	malicious	GuLoader	Browse
	Eparch.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Eparch.exe	Get hash	malicious	GuLoader	Browse
	Request for Quotation # 3200025006.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Settings.ini

Download File

Process:	C:\Users\user\Desktop\Nondesistance.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.78778203183594
Encrypted:	false
SSDEEP:	3:iGAIEXrcAQLQIfLBJXmgxv:lAIccAQkIP2I
MD5:	F5FDC9A00B0149608E24C58FD5249EA4
SHA1:	E2D50A7CDC8E7A9F9CC9F86074AE23F86A32F841
SHA-256:	12D2CA5CF65237CE9AC610E3A80AD20135A76D7E62C1FD92DED6CEA68F774C7C
SHA-512:	178DFAB68C39D0D58650B5AEECB702002E82683CD44777920AD884DA89C31BBD1164345CF7F1EC11CD851A249CB4CD7DA0C546C048AADB47F00B7A21304BC7F4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Access]..Early=user32::EnumWindows(i r1 ,i 0)..

C:\Users\user\AppData\Local\Temp\nsh2633.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Nondesistance.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.770824470205811
Encrypted:	false
SSDEEP:	192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
MD5:	B8992E497D57001DDF100F9C397FCEF5
SHA1:	E26DDF101A2EC5027975D2909306457C6F61CFBD
SHA-256:	98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B
SHA-512:	8823B1904DCCFAF031068102CB1DEF7958A057F49FF369F0E061F1B4DB2090021AA620BB8442A2A6AC9355BB74EE54371DC2599C20DC723755A46EDE81533A3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: Platosammine.exe, Detection: malicious, Browse Filename: FRA.0038222.exe, Detection: malicious, Browse Filename: Platosammine.exe, Detection: malicious, Browse Filename: FRA.0038222.exe, Detection: malicious, Browse Filename: file.zip, Detection: malicious, Browse Filename: Borgerreprsentants.exe, Detection: malicious, Browse Filename: Borgerreprsentants.exe, Detection: malicious, Browse Filename: Eparch.exe, Detection: malicious, Browse Filename: Eparch.exe, Detection: malicious, Browse Filename: Request for Quotation # 3200025006.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....z.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\betnksomme.lnk

Download File

Process:	C:\Users\user\Desktop\Nondesistance.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	908
Entropy (8bit):	3.137333725775644
Encrypted:	false
SSDEEP:	12:8wl0vsXowAOcQ/tz0/CSL/KlDe5MJysDekRyDmzTCNfBT/v4t2YZ/elFlSJm:8QLDWL/K5eusGekOmOpdqy
MD5:	C887B70B025831810024B2569EE7326A
SHA1:	F5DF9F2A204388497898511BB5A9B957F69F02E7
SHA-256:	E157DB6B603C2A28693FF7F21C9EDBFF51D1590227C8E33C2A3185735095E99B
SHA-512:	554C04170635CFEA48621C0928F59473527B254F4F88ADAAE271280B33081FEDB895EC7F32FC0A4EF4EFECBC26FD96622F08DA87247EEF565D87923C9C306F88
Malicious:	false
Reputation:	low
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....r.2...........immoralizing.tar..R............................................i.m.m.o.r.a.l.i.z.i.n.g...t.a.r... ...#.....\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.i.m.m.o.r.a.l.i.z.i.n.g...t.a.r...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.d.e.w.a.t.e.r.\.r.e.i.n.s.m.e.n.............y.............>.e.L.:..er.=y...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.................

C:\Users\user\dewater\reinsmen\Transversally.Nor

Download File

Process:	C:\Users\user\Desktop\Nondesistance.exe
File Type:	data
Category:	dropped
Size (bytes):	335679
Entropy (8bit):	7.6760597278088785
Encrypted:	false
SSDEEP:	6144:7c4er9ypF/PERLfJCNY0REpE15xL+cRHQdo:7TeriFufJC0axLVf
MD5:	89A22809A4D9410B8EC476B4FD7A47F6
SHA1:	F4562B8538F640E67D0BD4D5D45218C12587F64A
SHA-256:	F720F87C41DD1FD5068412983F93280011C03E00D6C2CA9A4B229C2CF38F82B3
SHA-512:	8CA7140806DF7BAEE123D39FE598A3919A76EAFD4E7A2229386786F8A62A781BE38DEBBCB6C551026B1B4EC7AFC957EFF580E6ED4BD010D36A5C35BF105DB467
Malicious:	false
Reputation:	low
Preview:	..........r..................hhhhhh.......VV.......................................II..............[[..........C..................~....~~..........h.sss..K.BBB..{.........K......yy..................................;;................AA.................U..zzzzzz.e.b.................................J...........p.`..e...m...................................................H.........__......a.22......................111..........99......G.cc.....1..}}}}}...............$...........C.....................................r.........w._......ssss.......E.E......A.:::....i..........PP.......................p.........ZZZZ.. .............................A........[[...;.(...c..%.yyyyy.........B.*.......{{.......................)....../.......................%.......z..............yyy.......w..JJJJJ..............................................99..................................t.....\|...........................[[.kk...t...s......._...GGGGGGG.!...........>...........]].......................''...s..

C:\Users\user\dewater\reinsmen\Undisclaimed.smi

Download File

Process:	C:\Users\user\Desktop\Nondesistance.exe
File Type:	data
Category:	dropped
Size (bytes):	1156117
Entropy (8bit):	0.15837846074819772
Encrypted:	false
SSDEEP:	768:lw/QDanxkHslOtDNAzJhjvMhXij4BgUdFaCLRgWLdGvI6r2C:
MD5:	15086A2F35483FA21698895B6782DF8E
SHA1:	6AD798618E183D7FEBF163B039C3AE2FB50B2CD9
SHA-256:	4B0C2B861F5C47806E6867575455247161434E204ADB92AB64E4833704A766D4
SHA-512:	7E350909621DC8E8E3AA306345B51A5EFFC6539A505797CCD41C26757DD57ABEBC812A2DA0BCB75E1352FD9CC1BFC01988E646C8B979EBF11C5358BBE945E2F1
Malicious:	false
Reputation:	low
Preview:	.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................C.......................................................................................................................................................................................................................................................................................................................................................................................................\......................................................................

C:\Users\user\dewater\reinsmen\blyindholdene.irr

Download File

Process:	C:\Users\user\Desktop\Nondesistance.exe
File Type:	data
Category:	dropped
Size (bytes):	1082113
Entropy (8bit):	0.15825869931191344
Encrypted:	false
SSDEEP:	768:y2tg6J3SwdsrlFv3IPRJhGeRG0KNBTIIxWTn69lRFHoDmO:2c
MD5:	C2380BB148EBA394BBCAAE245586A67F
SHA1:	020741FF474FC23B667F62EDD835D4C49E2A92DF
SHA-256:	DE656771FCE0CF164EB1876321D1EC9033DA5BE088B07F98EBAA6F9CABBFC149
SHA-512:	264F1832D6E002948F9EACA63EF663580557F7D8B21143D2E3BB06D1F07797C2428674ED9EAF67FE308B98D8A4964794118B2AAAE8CBAB01EBA4EB139D4400AE
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................Q................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................h..............................................................................................................................................

C:\Users\user\dewater\reinsmen\danite.txt

Download File

Process:	C:\Users\user\Desktop\Nondesistance.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	483
Entropy (8bit):	4.2279428457950745
Encrypted:	false
SSDEEP:	12:bFgRYHQ/LqFV/mMka7LsQIaKfMJ10bQSEX/bNs2LvKAVTKn:bFgouWH/mMkpQRXJ10sSEPb7CmTKn
MD5:	7822DA4CB788A4E45B36549F28A392C8
SHA1:	9B9AD515D5B1042E6C6C3D7F766AA318D69AF5A2
SHA-256:	B08B0B8C9E2DC6B97815501883D21EC3849A978B91ABE0B685FAD68C6272411B
SHA-512:	FEB7336D0A92134F25EF9814C643CE903A0C4816E887FA040CC890DEB428083C17BE97EE120E9B43C176405B6F6E6CDF9B504D6D3B5C22E18E70EE69C5C32E78
Malicious:	false
Reputation:	low
Preview:	statsrevisors noninstitutionally despairs amphistomatic inclination speciated etagen.piruetter nodestativ polyamylose afresca legions superincumbently prisndringers postaxiad bottomrying sekstendedelsnodernes fascis huastec..smergledes srbeskatningens filologiens slaaerens sextains,prehensorial misundelsesvrdigeres anchors riotry blgvanters.siliqua amtsligningsraadenes pulses kyra suffisance thumbing stomatorrhagia..unitude nonagrarian retear embowl slageren gaardhaven swarajes.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.212836401994695
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Nondesistance.exe
File size:	878'808 bytes
MD5:	9695b61f42f2e5a77e2e8d29963fe980
SHA1:	92396f929ffc0ec1c2929dcba7fa2b3de5859bc0
SHA256:	1c6b868bda50a13de084c97460436742b1636b75e60708eeecb9c44d574ccce9
SHA512:	58921b73bcd5986bd568bf9d7adcfb737c0fd42e873924f183ea1197d669902842c23b191a12bf0446cb9fbe644fd10ff5418d0c125e69f6393c6e1c8ddef0bb
SSDEEP:	12288:ZVcDbJfzoHrfKapRad9PqECAkRQkWw4QSsOWatBhP5FnM:4DbJfzUrCaSLPqECAkRWtTPM
TLSH:	F8159C16B7B48A13C10747338CA38BD56275EF94AE629B0F3258B2196F713EF07462D6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L....z.W.................`...\|.....

File Icon


Icon Hash:	7b29343736230907

Static PE Info

General

Entrypoint:	0x40310f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57017AB3 [Sun Apr 3 20:18:59 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Dagln@ruralism.El, O=Hvalrosserne, OU="Transcendentalized Giftemoden ", CN=Hvalrosserne, L=Juvanz\xe9, S=Grand Est, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	01/04/2024 08:46:43 01/04/2027 08:46:43
Subject Chain	E=Dagln@ruralism.El, O=Hvalrosserne, OU="Transcendentalized Giftemoden ", CN=Hvalrosserne, L=Juvanz\xe9, S=Grand Est, C=FR
Version:	3
Thumbprint MD5:	8D105C0C6085F945D3F5F7E86F35AFCC
Thumbprint SHA-1:	1A750729FC907CE0EF0427253002457A2BA98ABC
Thumbprint SHA-256:	FF0CB3B10B1950EDD600C121B64451FE8063F88F4A64AD3F00113079E45E9EFC
Serial:	111C3B47C01A9D77B4B65F7933B21D62CFAECA4C

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F9BF4D4C323h
push ebx
call 00007F9BF4D4F291h
cmp eax, ebx
je 00007F9BF4D4C319h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F9BF4D4F20Dh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F9BF4D4C2FDh
push ebp
push 00000009h
call 00007F9BF4D4F264h
push 00000007h
call 00007F9BF4D4F25Dh
mov dword ptr [0042E404h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [0042E4B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00428828h
call dword ptr [00407174h]
push 00409188h
push 0042DC00h
call 00007F9BF4D4EE87h
call dword ptr [0040709Ch]
mov ebp, 00434000h
push eax
push ebp
call 00007F9BF4D4EE75h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7534	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x48000	0x70d00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd5480	0x1458
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fdd	0x6000	62681be921484302edbc551e93c6d357	False	0.6784261067708334	data	6.499724004795778	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1352	0x1400	3d134ae5961af9895950a7ee0adc520a	False	0.4583984375	data	5.207538993430304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x254f8	0x600	2d00401e0c64d69b6d0ccb877d9f624e	False	0.4544270833333333	data	4.0323505938358934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2f000	0x19000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x48000	0x70d00	0x70e00	ee0de397650a8a3850a4c21fb750a9e0	False	0.2557144587486157	data	3.819328483239704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x483b8	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.2202007574636802
RT_ICON	0x8a3e0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.2796048740092275
RT_ICON	0x9ac08	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.30720517132646624
RT_ICON	0xa40b0	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.326203007518797
RT_ICON	0xaa898	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.34015711645101665
RT_ICON	0xafd20	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.35657770429853564
RT_ICON	0xb3f48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3848547717842324
RT_ICON	0xb64f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.46646341463414637
RT_ICON	0xb7598	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5163934426229508
RT_ICON	0xb7f20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5966312056737588
RT_DIALOG	0xb8388	0x100	data	English	United States	0.5234375
RT_DIALOG	0xb8488	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xb85a8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xb8670	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xb86d0	0x92	data	English	United States	0.6986301369863014
RT_VERSION	0xb8768	0x258	data	English	United States	0.49166666666666664
RT_MANIFEST	0xb89c0	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:22:02
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\Nondesistance.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Nondesistance.exe"
Imagebase:	0x400000
File size:	878'808 bytes
MD5 hash:	9695B61F42F2E5A77E2E8D29963FE980
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.4140963673.0000000004D6E000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Nondesistance.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Settings.ini

C:\Users\user\AppData\Local\Temp\nsh2633.tmp\System.dll

C:\Users\user\Desktop\betnksomme.lnk

C:\Users\user\dewater\reinsmen\Transversally.Nor

C:\Users\user\dewater\reinsmen\Undisclaimed.smi

C:\Users\user\dewater\reinsmen\blyindholdene.irr

C:\Users\user\dewater\reinsmen\danite.txt

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

Windows Analysis Report
Nondesistance.exe