Edit tour

Windows Analysis Report
cTgYsJEANZ.exe

Overview

General Information

Sample name:	cTgYsJEANZ.exe renamed because original name is a hash value
Original sample name:	cac77e1df9d179c4febe6e2a557bb32b.exe
Analysis ID:	1632286
MD5:	cac77e1df9d179c4febe6e2a557bb32b
SHA1:	d7df5da6790068408ddc055c94a4364525603103
SHA256:	02596ab86597670e98b7d1fa7cf26fd3a01a012f1e73eae0dbbdf55db80b6149
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Injects code into the Windows Explorer (explorer.exe)

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cTgYsJEANZ.exe (PID: 7684 cmdline: "C:\Users\user\Desktop\cTgYsJEANZ.exe" MD5: CAC77E1DF9D179C4FEBE6E2A557BB32B)

SplashWin.exe (PID: 7856 cmdline: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe MD5: 4D20B83562EEC3660E45027AD56FB444)

SplashWin.exe (PID: 7928 cmdline: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe MD5: 4D20B83562EEC3660E45027AD56FB444)

cmd.exe (PID: 7944 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 2592 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SplashWin.exe (PID: 2692 cmdline: "C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe" MD5: 4D20B83562EEC3660E45027AD56FB444)

cmd.exe (PID: 652 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 1904 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

cleanup

Sigma Signatures

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Windows\SysWOW64\explorer.exe, CommandLine: C:\Windows\SysWOW64\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\explorer.exe, NewProcessName: C:\Windows\SysWOW64\explorer.exe, OriginalFileName: C:\Windows\SysWOW64\explorer.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7944, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\explorer.exe, ProcessId: 2592, ProcessName: explorer.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\fmoe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\sidwwucavy	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\fmoe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\sidwwucavy	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: cTgYsJEANZ.exe	Virustotal: Detection: 33%			Perma Link
Source: cTgYsJEANZ.exe	ReversingLabs: Detection: 23%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:	Binary string: E:\workdir\vc\rbin\RCClient\SplashWin.pdb,, source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1285023656.0000000000DA3000.00000002.00000001.01000000.00000007.sdmp, SplashWin.exe, 00000003.00000000.1276820663.0000000000DA3000.00000002.00000001.01000000.00000007.sdmp, SplashWin.exe, 00000005.00000000.1284350705.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 00000005.00000002.1342375327.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 0000000C.00000000.1509511213.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 0000000C.00000002.1568966757.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe.3.dr, SplashWin.exe.0.dr
Source:	Binary string: E:\workdir\ProgramDatabase\DuiLib_u.pdbww3 source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290755518.000000006D815000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000005.00000002.1349856107.000000006D3C5000.00000002.00000001.01000000.0000000D.sdmp, SplashWin.exe, 0000000C.00000002.1573758515.000000006D735000.00000002.00000001.01000000.0000000D.sdmp, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr
Source:	Binary string: ntdll.pdb source: cTgYsJEANZ.exe, 00000000.00000002.1345779864.0000000006910000.00000004.00000800.00020000.00000000.sdmp, cTgYsJEANZ.exe, 00000000.00000002.1332304326.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: SplashWin.exe, 00000003.00000002.1290272799.000000000A1A6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290433336.000000000A500000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1347575843.0000000009B60000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1348095012.0000000009F1B000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1347368947.000000000980C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1565250853.0000000004F02000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566933841.0000000005440000.00000004.00001000.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572878956.0000000009CD0000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1573098316.000000000A08C000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572746578.0000000009978000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778392677.0000000004C91000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778947237.00000000051C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: cTgYsJEANZ.exe, 00000000.00000002.1345779864.0000000006910000.00000004.00000800.00020000.00000000.sdmp, cTgYsJEANZ.exe, 00000000.00000002.1332304326.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SplashWin.exe, 00000003.00000002.1290272799.000000000A1A6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290433336.000000000A500000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1347575843.0000000009B60000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1348095012.0000000009F1B000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1347368947.000000000980C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1565250853.0000000004F02000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566933841.0000000005440000.00000004.00001000.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572878956.0000000009CD0000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1573098316.000000000A08C000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572746578.0000000009978000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778392677.0000000004C91000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778947237.00000000051C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\workdir\ProgramDatabase\DuiLib_u.pdb source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290755518.000000006D815000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000005.00000002.1349856107.000000006D3C5000.00000002.00000001.01000000.0000000D.sdmp, SplashWin.exe, 0000000C.00000002.1573758515.000000006D735000.00000002.00000001.01000000.0000000D.sdmp, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr
Source:	Binary string: E:\workdir\vc\rbin\RCClient\SplashWin.pdb source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1285023656.0000000000DA3000.00000002.00000001.01000000.00000007.sdmp, SplashWin.exe, 00000003.00000000.1276820663.0000000000DA3000.00000002.00000001.01000000.00000007.sdmp, SplashWin.exe, 00000005.00000000.1284350705.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 00000005.00000002.1342375327.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 0000000C.00000000.1509511213.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 0000000C.00000002.1568966757.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe.3.dr, SplashWin.exe.0.dr
Source:	Binary string: D:\agent\_work\20\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1283552135.0000000001562000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1291003156.000000006ED91000.00000020.00000001.01000000.00000009.sdmp, SplashWin.exe, 00000005.00000002.1349465168.000000006D331000.00000020.00000001.01000000.0000000E.sdmp, SplashWin.exe, 0000000C.00000002.1573873839.000000006D7A1000.00000020.00000001.01000000.0000000E.sdmp, vcruntime140.dll.3.dr, vcruntime140.dll.0.dr
Source:	Binary string: D:\agent\_work\20\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: SplashWin.exe, SplashWin.exe, 00000005.00000002.1349230520.000000006D2B1000.00000020.00000001.01000000.0000000F.sdmp, SplashWin.exe, 0000000C.00000002.1573586465.000000006D641000.00000020.00000001.01000000.0000000F.sdmp, msvcp140.dll.3.dr, msvcp140.dll.0.dr

Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe

Code function: 5_2_6D2C20D0 _Open_dir,FindFirstFileExW,__Read_dir,FindClose,

5_2_6D2C20D0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 185.183.32.103 3333

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.4:49720 -> 185.183.32.103:3333

Source: Joe Sandbox View

ASN Name: WORLDSTREAMNL WORLDSTREAMNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.183.32.103

Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009EBD000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009621000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.000000000526F000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.0000000009796000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.0000000004FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1282470227.0000000001561000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe.3.dr, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr, SplashWin.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290068660.0000000009F13000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1346880831.0000000009677000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566727187.00000000052B7000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572581044.00000000097EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

Code function: 3_2_6D7D88DB GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

3_2_6D7D88DB

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

Code function: 0_2_0077A88F NtQuerySystemInformation,

0_2_0077A88F

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Code function: 0_2_0077E57A	0_2_0077E57A
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7ED565	3_2_6D7ED565
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7EBD34	3_2_6D7EBD34
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7EEC71	3_2_6D7EEC71
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D8054D8	3_2_6D8054D8
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7DFCA0	3_2_6D7DFCA0
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D8077AA	3_2_6D8077AA
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D804770	3_2_6D804770
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D805E77	3_2_6D805E77
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7A2052	3_2_6D7A2052
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7E78E5	3_2_6D7E78E5
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7E68BD	3_2_6D7E68BD
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7EA345	3_2_6D7EA345
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7EE315	3_2_6D7EE315
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7D23BF	3_2_6D7D23BF
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7E8208	3_2_6D7E8208
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B1E07	5_2_6D2B1E07
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B4EE0	5_2_6D2B4EE0
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B4EC4	5_2_6D2B4EC4
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B4BCC	5_2_6D2B4BCC
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B658C	5_2_6D2B658C
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B65EC	5_2_6D2B65EC
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B642C	5_2_6D2B642C
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B6458	5_2_6D2B6458
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B6494	5_2_6D2B6494
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B14F2	5_2_6D2B14F2
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B6618	5_2_6D2B6618
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B66E4	5_2_6D2B66E4
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B66D4	5_2_6D2B66D4
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B4EC4	5_2_6D2B4EC4
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B4BCC	5_2_6D2B4BCC

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\KM_daemon\DuiLib_u.dll 5A3E6B212447ECEE8E9A215C35F56AA3A3F45340F116AD9015C87D0C9C6E21AF
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe C5E650B331FA5292872FDAEDE3A75C8167A0F1280CE0CD3D58B880D23854BDB1
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\KM_daemon\msvcp140.dll 4CB882621A3D1C6283570447F842801B396DB1B3DCD2E01C2F7002EFD66A0A97

Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: String function: 6D2EE6CF appears 38 times
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: String function: 6D2EE69B appears 123 times
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: String function: 6D7E9047 appears 43 times

Source: cTgYsJEANZ.exe

Static PE information: Number of sections : 11 > 10

Source: fmoe.6.dr	Static PE information: No import functions for PE file found
Source: sidwwucavy.13.dr	Static PE information: No import functions for PE file found

Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.000000000798D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000002.1345779864.0000000006A96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.0000000005B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000002.1332304326.0000000003605000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000000.1245277799.0000000000427000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dllT vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAnyViewer4 vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000002.1333898257.00000000064F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameiScrEditer.exeJ vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe, 00000000.00000002.1330720364.0000000002A46000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecomctl32.DLL.MUIj% vs cTgYsJEANZ.exe
Source: cTgYsJEANZ.exe	Binary or memory string: OriginalFileName vs cTgYsJEANZ.exe

Source: classification engine

Classification label: mal100.evad.winEXE@17/20@0/1

Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe

Code function: 5_2_6D2C2440 _Statvfs,GetDiskFreeSpaceExW,

5_2_6D2C2440

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

Code function: 3_2_6D7D57A2 ??0CDragSourceHelper@DuiLib@@QAE@XZ,CoCreateInstance,

3_2_6D7D57A2

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

File created: C:\Users\user\AppData\Roaming\PersBackup6

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7684:120:WilError_03

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

File created: C:\Users\user\AppData\Local\Temp\7756466e

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Command line argument: AnyViewer		3_2_00DA19D0
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Command line argument: AnyViewer		5_2_001719D0

Source: cTgYsJEANZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cTgYsJEANZ.exe	Virustotal: Detection: 33%
Source: cTgYsJEANZ.exe	ReversingLabs: Detection: 23%

Source: cTgYsJEANZ.exe

String found in binary or memory: pbe-help.chm

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

File read: C:\Users\user\Desktop\cTgYsJEANZ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cTgYsJEANZ.exe "C:\Users\user\Desktop\cTgYsJEANZ.exe"
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Process created: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Process created: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe "C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe"
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Process created: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Process created: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: duilib_u.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: duilib_u.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: duilib_u.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: ljmvxrux.6.dr

LNK file: ..\..\Roaming\KM_daemon\SplashWin.exe

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: cTgYsJEANZ.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: cTgYsJEANZ.exe

Static file information: File size 10493128 > 1048576

Source: cTgYsJEANZ.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x484a00
Source: cTgYsJEANZ.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x486000

Source:	Binary string: E:\workdir\vc\rbin\RCClient\SplashWin.pdb,, source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1285023656.0000000000DA3000.00000002.00000001.01000000.00000007.sdmp, SplashWin.exe, 00000003.00000000.1276820663.0000000000DA3000.00000002.00000001.01000000.00000007.sdmp, SplashWin.exe, 00000005.00000000.1284350705.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 00000005.00000002.1342375327.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 0000000C.00000000.1509511213.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 0000000C.00000002.1568966757.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe.3.dr, SplashWin.exe.0.dr
Source:	Binary string: E:\workdir\ProgramDatabase\DuiLib_u.pdbww3 source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290755518.000000006D815000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000005.00000002.1349856107.000000006D3C5000.00000002.00000001.01000000.0000000D.sdmp, SplashWin.exe, 0000000C.00000002.1573758515.000000006D735000.00000002.00000001.01000000.0000000D.sdmp, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr
Source:	Binary string: ntdll.pdb source: cTgYsJEANZ.exe, 00000000.00000002.1345779864.0000000006910000.00000004.00000800.00020000.00000000.sdmp, cTgYsJEANZ.exe, 00000000.00000002.1332304326.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: SplashWin.exe, 00000003.00000002.1290272799.000000000A1A6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290433336.000000000A500000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1347575843.0000000009B60000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1348095012.0000000009F1B000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1347368947.000000000980C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1565250853.0000000004F02000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566933841.0000000005440000.00000004.00001000.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572878956.0000000009CD0000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1573098316.000000000A08C000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572746578.0000000009978000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778392677.0000000004C91000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778947237.00000000051C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: cTgYsJEANZ.exe, 00000000.00000002.1345779864.0000000006910000.00000004.00000800.00020000.00000000.sdmp, cTgYsJEANZ.exe, 00000000.00000002.1332304326.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SplashWin.exe, 00000003.00000002.1290272799.000000000A1A6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290433336.000000000A500000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1347575843.0000000009B60000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1348095012.0000000009F1B000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000005.00000002.1347368947.000000000980C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1565250853.0000000004F02000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000006.00000002.1566933841.0000000005440000.00000004.00001000.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572878956.0000000009CD0000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1573098316.000000000A08C000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 0000000C.00000002.1572746578.0000000009978000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778392677.0000000004C91000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.1778947237.00000000051C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\workdir\ProgramDatabase\DuiLib_u.pdb source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1290755518.000000006D815000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000005.00000002.1349856107.000000006D3C5000.00000002.00000001.01000000.0000000D.sdmp, SplashWin.exe, 0000000C.00000002.1573758515.000000006D735000.00000002.00000001.01000000.0000000D.sdmp, DuiLib_u.dll.3.dr, DuiLib_u.dll.0.dr
Source:	Binary string: E:\workdir\vc\rbin\RCClient\SplashWin.pdb source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1285023656.0000000000DA3000.00000002.00000001.01000000.00000007.sdmp, SplashWin.exe, 00000003.00000000.1276820663.0000000000DA3000.00000002.00000001.01000000.00000007.sdmp, SplashWin.exe, 00000005.00000000.1284350705.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 00000005.00000002.1342375327.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 0000000C.00000000.1509511213.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe, 0000000C.00000002.1568966757.0000000000173000.00000002.00000001.01000000.0000000C.sdmp, SplashWin.exe.3.dr, SplashWin.exe.0.dr
Source:	Binary string: D:\agent\_work\20\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: cTgYsJEANZ.exe, 00000000.00000002.1348379963.00000000075E6000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000003.1283552135.0000000001562000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1291003156.000000006ED91000.00000020.00000001.01000000.00000009.sdmp, SplashWin.exe, 00000005.00000002.1349465168.000000006D331000.00000020.00000001.01000000.0000000E.sdmp, SplashWin.exe, 0000000C.00000002.1573873839.000000006D7A1000.00000020.00000001.01000000.0000000E.sdmp, vcruntime140.dll.3.dr, vcruntime140.dll.0.dr
Source:	Binary string: D:\agent\_work\20\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: SplashWin.exe, SplashWin.exe, 00000005.00000002.1349230520.000000006D2B1000.00000020.00000001.01000000.0000000F.sdmp, SplashWin.exe, 0000000C.00000002.1573586465.000000006D641000.00000020.00000001.01000000.0000000F.sdmp, msvcp140.dll.3.dr, msvcp140.dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

Code function: 3_2_6D7A315F ?DoCreateControl@CActiveXUI@DuiLib@@MAEHXZ,__EH_prolog3_catch,?IsEmpty@CDuiString@DuiLib@@QBEHXZ,??BCDuiString@DuiLib@@QBEPB_WXZ,LoadLibraryW,GetProcAddress,CoCreateInstance,?SendNotify@CPaintManagerUI@DuiLib@@QAEXPAVCControlUI@2@PB_WIJH@Z,?GetPaintWindow@CPaintManagerUI@DuiLib@@QBEPAUHWND__@@XZ,

3_2_6D7A315F

Source: DuiLib_u.dll.3.dr	Static PE information: real checksum: 0xda891 should be: 0xda31a
Source: fmoe.6.dr	Static PE information: real checksum: 0x0 should be: 0x117ba0
Source: sidwwucavy.13.dr	Static PE information: real checksum: 0x0 should be: 0x117ba0
Source: DuiLib_u.dll.0.dr	Static PE information: real checksum: 0xda891 should be: 0xda31a

Source: cTgYsJEANZ.exe	Static PE information: section name: .didata
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: fmoe.6.dr	Static PE information: section name: .xyz
Source: fmoe.6.dr	Static PE information: section name: eyp
Source: sidwwucavy.13.dr	Static PE information: section name: .xyz
Source: sidwwucavy.13.dr	Static PE information: section name: eyp

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_00DA2A26 push ecx; ret	3_2_00DA2A39
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7E9FDF push ecx; mov dword ptr [esp], 3F800000h	3_2_6D7E9FFB
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D80C16F push ecx; ret	3_2_6D80C182
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7A2052 push ecx; mov dword ptr [esp], 3F800000h	3_2_6D7A2289
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_00172A26 push ecx; ret	5_2_00172A39
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2EE675 push ecx; ret	5_2_6D2EE688
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2B1119 pushad ; retn 0000h	5_2_6D2B12B0

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	File created: C:\Users\user\AppData\Roaming\KM_daemon\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	File created: C:\Users\user\AppData\Roaming\KM_daemon\DuiLib_u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	File created: C:\Users\user\AppData\Roaming\KM_daemon\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	File created: C:\Users\user\AppData\Local\Temp\KM_daemon\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\fmoe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	File created: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	File created: C:\Users\user\AppData\Local\Temp\KM_daemon\DuiLib_u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	File created: C:\Users\user\AppData\Local\Temp\KM_daemon\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	File created: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\sidwwucavy	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\fmoe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\sidwwucavy			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\FMOE
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\SIDWWUCAVY

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

Code function: 3_2_6D7BE04D ?OnSize@CMenuWnd@DuiLib@@UAEJIIJAAH@Z,?GetRoundCorner@CPaintManagerUI@DuiLib@@QBE?AUtagSIZE@@XZ,??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ,IsIconic,??0CDuiRect@DuiLib@@QAE@XZ,??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ,GetWindowRect,?Offset@CDuiRect@DuiLib@@QAEXHH@Z,CreateRoundRectRgn,??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ,SetWindowRgn,DeleteObject,

3_2_6D7BE04D

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\explorer.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	System information queried: FirmwareTableInformation			Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	API/Special instruction interceptor: Address: 6D499364
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	API/Special instruction interceptor: Address: 6D499364
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	API/Special instruction interceptor: Address: 6D499065
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6D493B54
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: B5A317
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: 941145
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: 34B1145

Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: foregroundWindowGot 667	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: foregroundWindowGot 660	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: foregroundWindowGot 494	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: foregroundWindowGot 502	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\fmoe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sidwwucavy			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

API coverage: 0.4 %

Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe

Code function: 5_2_6D2C20D0 _Open_dir,FindFirstFileExW,__Read_dir,FindClose,

5_2_6D2C20D0

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

Code function: 0_2_00415F30 GetSystemInfo,

0_2_00415F30

Source: cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: cmd.exe, 0000000D.00000002.1778812653.000000000503D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

Code function: 3_2_00DA1BA5 IsDebuggerPresent,OutputDebugStringW,

3_2_00DA1BA5

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

3_2_6D7A315F

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

Code function: 3_2_00DA14C0 GetProcessHeap,__Init_thread_footer,__Init_thread_footer,

3_2_00DA14C0

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_00DA27E0 SetUnhandledExceptionFilter,	3_2_00DA27E0
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_00DA264A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00DA264A
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_00DA2529 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00DA2529
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D80CFD7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6D80CFD7
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_00172529 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00172529
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_0017264A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0017264A
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_001727E0 SetUnhandledExceptionFilter,	5_2_001727E0
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2EEEB8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6D2EEEB8
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_6D2EF27B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6D2EF27B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 185.183.32.103 3333

Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	NtQuerySystemInformation: Direct from: 0x6D357625	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtClose: Direct from: 0x7FFC9DA4982C
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtAllocateVirtualMemory: Direct from: 0x7FFC9DA48E14	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtQuerySystemInformation: Direct from: 0x7FFC9DA36118	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtCreateFile: Direct from: 0x7FFC9DA497E6	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtProtectVirtualMemory: Direct from: 0x7FFC9DA4973A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	NtProtectVirtualMemory: Direct from: 0x755C8769	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtProtectVirtualMemory: Direct from: 0x7FFC9DA494F5	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	NtQuerySystemInformation: Direct from: 0x6D6C7625	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtAllocateVirtualMemory: Direct from: 0xA0A76ACB	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtClose: Direct from: 0x1C
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	NtQuerySystemInformation: Direct from: 0x6D7A7625	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtQuerySystemInformation: Direct from: 0x6C006C	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtWriteFile: Direct from: 0x7FFC9DA49822	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtAllocateVirtualMemory: Direct from: 0x7FFC9DA49635	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtAllocateVirtualMemory: Direct from: 0x7FFC9DA360D4	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	NtProtectVirtualMemory: Direct from: 0x75640353	Jump to behavior
Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	NtClose: Direct from: 0x29E0300

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 2592 base: B579C0 value: 55			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 1904 base: B579C0 value: 55			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\SysWOW64\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: B579C0			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: B579C0			Jump to behavior

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Process created: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

Code function: 3_2_00DA2835 cpuid

3_2_00DA2835

Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: _Getdateorder,___lc_locale_name_func,__crtGetLocaleInfoEx,		5_2_6D2D7770
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: __crtGetLocaleInfoEx,GetLocaleInfoEx,?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ,GetLocaleInfoEx,GetLocaleInfoW,		5_2_6D2BC160

Source: C:\Users\user\Desktop\cTgYsJEANZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7756466e VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe

Code function: 3_2_00DA2B75 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00DA2B75

Source: C:\Windows\SysWOW64\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_00DA13A0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	3_2_00DA13A0
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7A55EB ?BindTabLayoutName@CButtonUI@DuiLib@@UAEXPB_W@Z,	3_2_6D7A55EB
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7A55D7 ?BindTabIndex@CButtonUI@DuiLib@@UAEXH@Z,	3_2_6D7A55D7
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7A5604 ?BindTriggerTabSel@CButtonUI@DuiLib@@UAEXH@Z,?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@PB_W@Z,	3_2_6D7A5604
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7A58AE ?GetBindTabLayoutName@CButtonUI@DuiLib@@UAEPB_WXZ,	3_2_6D7A58AE
Source: C:\Users\user\AppData\Local\Temp\KM_daemon\SplashWin.exe	Code function: 3_2_6D7A58A7 ?GetBindTabLayoutIndex@CButtonUI@DuiLib@@UAEHXZ,	3_2_6D7A58A7
Source: C:\Users\user\AppData\Roaming\KM_daemon\SplashWin.exe	Code function: 5_2_001713A0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	5_2_001713A0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	11 DLL Side-Loading	411 Process Injection	11 Masquerading	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Virtualization/Sandbox Evasion	LSASS Memory	331 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	11 DLL Side-Loading	411 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	11 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 DLL Side-Loading	DCSync	135 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
cTgYsJEANZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cTgYsJEANZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
cTgYsJEANZ.exe