Analysis Report sfk_setup.exe

Overview

General Information

Sample Name: sfk_setup.exe
Analysis ID: 338143
MD5: 945d981860358a2da40321783865f6da
SHA1: df551d918354421e60b458cbd7a9032080835bc9
SHA256: 407ae7a2edaae00d7e109b746153310fcfed60104687bde65b90b9a46c85f655

Most interesting Screenshot:

Detection

Score: 42
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Creates an undocumented autostart registry key
Uses regedit.exe to modify the Windows registry
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains strange resources
Queries keyboard layouts
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: sfk_setup.exe Virustotal: Detection: 28% Perma Link
Source: sfk_setup.exe ReversingLabs: Detection: 25%
Antivirus or Machine Learning detection for unpacked file
Source: 21.2.spmm.exe.400000.0.unpack Avira: Label: TR/ATRAPS.Gen

Compliance:

barindex
Uses 32bit PE files
Source: sfk_setup.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED
Source: sfk_setup.exe Static PE information: certificate valid
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll
Source: unknown HTTPS traffic detected: 54.39.133.136:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: sfk_setup.exe Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Development\OpenSSL\Temp\openssl-1.0.1c-x32\out32dll\libeay32.pdb source: sfk_setup.tmp, 00000001.00000003.318099211.0000000005F17000.00000004.00000001.sdmp
Source: Binary string: C:\Development\OpenSSL\Temp\openssl-1.0.1c-x32\out32dll\libeay32.pdbpS source: sfk_setup.tmp, 00000001.00000003.318099211.0000000005F17000.00000004.00000001.sdmp
Source: Binary string: C:\Development\OpenSSL\Temp\openssl-1.0.1c-x32\out32dll\ssleay32.pdb source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00405BEC GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW, 0_2_00405BEC
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004AD294 FindFirstFileW,GetLastError, 1_2_004AD294
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00408174 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW, 1_2_00408174
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004FDF38 FindFirstFileW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose, 1_2_004FDF38
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_004099DC FindFirstFileW, 21_2_004099DC
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_0041491C FindFirstFileW, 21_2_0041491C
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_00409474 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW, 21_2_00409474
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00412380 FindFirstFileW,FindClose, 22_2_00412380
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00CC18B0 FindFirstFileW,FindClose, 22_2_00CC18B0
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior

Networking:

barindex
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: global traffic HTTP traffic detected: GET /spyrix-products.php?from=sfk_install HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.spyrix.comConnection: Keep-Alive
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: SearchID="http://www.myspace.com/search/" equals www.myspace.com (Myspace)
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: msgID="http://www.myspace.com/my/mail" equals www.myspace.com (Myspace)
Source: unknown DNS traffic detected: queries for: www.spyrix.com
Source: sfk_setup.tmp, 00000001.00000002.344377806.0000000005600000.00000002.00000001.sdmp String found in binary or memory: http://%s.com
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://amazon.fr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://arianna.libero.it/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://auone.jp/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.344377806.0000000005600000.00000002.00000001.sdmp String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://br.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busca.orange.es/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.lycos.es/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com.br/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.es/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://buscar.ozu.es/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://buscar.ya.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://busqueda.aol.com.mx/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://cerca.lycos.it/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://cnet.search.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://corp.naukri.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://css-tricks.com
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://de.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://es.ask.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://es.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://esearch.rakuten.co.jp/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://espanol.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://espn.go.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://find.joins.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://fr.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://google.pchome.com.tw/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://home.altervista.org/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://home.altervista.org/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://images.monster.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://in.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.dada.net/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://jobsearch.monster.com/
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://jqueryfordesigners.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://kr.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000003.338354456.00000000091E1000.00000004.00000001.sdmp String found in binary or memory: http://lame.sf.net
Source: sfk_setup.tmp, 00000001.00000003.338354456.00000000091E1000.00000004.00000001.sdmp String found in binary or memory: http://lame.sf.netD
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://list.taobao.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://mail.live.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://msk.afisha.ru/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://opensource.org/licenses/afl-3.0.php
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://pixelgraphics.us/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://price.ru/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://price.ru/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://rc.qzone.qq.com/qzonesoso/?search
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.linternaute.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.338285923.0000000009134000.00000004.00000001.sdmp String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: sfk_setup.tmp, 00000001.00000003.338285923.0000000009134000.00000004.00000001.sdmp String found in binary or memory: http://relaxng.org/ns/structure/1.0definenameincludegrammarcombinechoiceDefines
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://rover.ebay.com
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://ru.search.yahoo.com
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://sads.myspace.com/
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://schemas.mi
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp, sfk_setup.tmp, 00000001.00000003.325756750.0000000006EFA000.00000004.00000001.sdmp String found in binary or memory: http://schemas.mic
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://schemas.micr
Source: sfk_setup.tmp, 00000001.00000003.325756750.0000000006EFA000.00000004.00000001.sdmp String found in binary or memory: http://schemas.microsof
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://schemas.microsoft.co
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search-dyn.tiscali.it/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.about.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.alice.it/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.alice.it/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.in/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.atlas.cz/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.auction.co.kr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.auone.jp/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.books.com.tw/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.centrum.cz/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.chol.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.chol.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.cn.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.daum.net/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.daum.net/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.es/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.fr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.in/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.it/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.empas.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.empas.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.espn.go.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.gismeteo.ru/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.hanafos.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.interpark.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.livedoor.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.nate.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.naver.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.naver.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.nifty.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.rediff.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.rediff.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.seznam.cz/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.sify.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search.yam.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search1.taobao.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://search2.estadao.com.br/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://searchresults.news.com.au/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://service2.bfast.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: spkl.exe String found in binary or memory: http://spyrix.com/manual.php
Source: spkl.exe String found in binary or memory: http://spyrix.net/promo/dashboard/index.shtml?
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://suche.aol.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://suche.freenet.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://suche.lycos.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://suche.t-online.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://suche.web.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://suche.web.de/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.344377806.0000000005600000.00000002.00000001.sdmp String found in binary or memory: http://treyresearch.net
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://tw.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://udn.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://udn.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://uk.ask.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://uk.ask.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://uk.search.yahoo.com/
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://user.qzone.qq.com
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://vachercher.lycos.fr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://video.globo.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://video.globo.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://vk.com/search
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://web.ask.com/
Source: sfk_setup.tmp, 00000001.00000002.344377806.0000000005600000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.com
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.abril.com.br/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: spkl.exe String found in binary or memory: http://www.actualkeylogger.com/buynow.html
Source: spkl.exe String found in binary or memory: http://www.actualkeylogger.com/help.html
Source: spkl.exe String found in binary or memory: http://www.actualkeylogger.com/help.html#registrate
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.co.jp/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&amp;keyword=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&amp;tag=ie8search-20&amp;index=blended&amp;linkCode=qs&amp;c
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.aol.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.arrakis.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.ask.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.baidu.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.baidu.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.338285923.0000000009134000.00000004.00000001.sdmp String found in binary or memory: http://www.brynosaurus.com/cachedir/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.cjmall.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.clarin.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.cnet.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.cnet.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: sfk_setup.exe, 00000000.00000003.209952617.0000000002480000.00000004.00000001.sdmp, sfk_setup.tmp, 00000001.00000003.212148023.0000000003170000.00000004.00000001.sdmp String found in binary or memory: http://www.dk-soft.org/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.docUrl.com/bar.htm
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.excite.co.jp/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.in/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.jp/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.uk/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.br/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.sa/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.tw/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.cz/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.es/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.fr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.it/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.pl/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.ru/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.si/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.iask.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.iask.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.338505056.0000000009303000.00000004.00000001.sdmp, spkl.exe, spmm.exe String found in binary or memory: http://www.indyproject.org/
Source: sfk_setup.exe, 00000000.00000003.210213490.00000000025C0000.00000004.00000001.sdmp, sfk_setup.tmp, sfk_setup.tmp, 00000001.00000000.211570445.0000000000401000.00000020.00020000.sdmp String found in binary or memory: http://www.innosetup.com/
Source: sfk_setup.exe String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: sfk_setup.exe, 00000000.00000002.348991733.0000000000401000.00000020.00020000.sdmp String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://www.magentocommerce.com
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://www.magentocommerce.com)
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&amp;a=
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.mtv.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.mtv.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.myspace.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://www.myspace.com/my/mail
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://www.myspace.com/search/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.najdi.si/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.najdi.si/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.nate.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.neckermann.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.news.com.au/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.nifty.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.338285923.0000000009134000.00000004.00000001.sdmp String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: sfk_setup.tmp, 00000001.00000003.338285923.0000000009134000.00000004.00000001.sdmp String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://www.ok.ru/dk?st.cmd=searchResult
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://www.openssl.org/V
Source: sfk_setup.tmp, 00000001.00000003.318099211.0000000005F17000.00000004.00000001.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html
Source: sfk_setup.tmp, 00000001.00000003.318099211.0000000005F17000.00000004.00000001.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.orange.fr/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.otto.de/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozon.ru/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozu.es/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.priceminister.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.rambler.ru/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.recherche.aol.fr/
Source: sfk_setup.exe, 00000000.00000003.210213490.00000000025C0000.00000004.00000001.sdmp, sfk_setup.tmp String found in binary or memory: http://www.remobjects.com/ps
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.rtl.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.rtl.de/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.servicios.clarin.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.shopzilla.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.sify.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.sogou.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.sogou.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.soso.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.soso.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.339705822.000000000230A000.00000004.00000001.sdmp, spkl.exe String found in binary or memory: http://www.spyrix.com
Source: sfk_setup.exe, 00000000.00000003.348789313.000000000231A000.00000004.00000001.sdmp, sfk_setup.tmp, 00000001.00000003.212148023.0000000003170000.00000004.00000001.sdmp String found in binary or memory: http://www.spyrix.com/
Source: spkl.exe String found in binary or memory: http://www.spyrix.com/manual.php#registrate
Source: spkl.exe String found in binary or memory: http://www.spyrix.com/pro_upgrade.htm?lic=
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp, sfk_setup.tmp, 00000001.00000003.325756750.0000000006EFA000.00000004.00000001.sdmp, spkl.exe String found in binary or memory: http://www.spyrix.com/purchase.php
Source: sfk_setup.tmp, 00000001.00000003.339821308.00000000008DE000.00000004.00000001.sdmp String found in binary or memory: http://www.spyrix.com/spyrix-products.php?from=sfk_install
Source: sfk_setup.tmp, 00000001.00000003.339821308.00000000008DE000.00000004.00000001.sdmp String found in binary or memory: http://www.spyrix.com/spyrix-products.php?from=sfk_install#
Source: sfk_setup.tmp, 00000001.00000003.339821308.00000000008DE000.00000004.00000001.sdmp String found in binary or memory: http://www.spyrix.com/spyrix-products.php?from=sfk_installb
Source: sfk_setup.tmp, 00000001.00000003.339105902.0000000005130000.00000004.00000001.sdmp String found in binary or memory: http://www.spyrix.com/spyrix-products.php?from=sfk_installh
Source: sfk_setup.tmp, 00000001.00000003.212148023.0000000003170000.00000004.00000001.sdmp String found in binary or memory: http://www.spyrix.com/terms-of-use.php)
Source: spkl.exe String found in binary or memory: http://www.spyrix.net/ibann
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.t-online.de/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.taobao.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.taobao.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.target.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.target.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.tchibo.de/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.tesco.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.tesco.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.338354456.00000000091E1000.00000004.00000001.sdmp String found in binary or memory: http://www.twolame.org
Source: sfk_setup.tmp, 00000001.00000003.338354456.00000000091E1000.00000004.00000001.sdmp String found in binary or memory: http://www.twolame.orgMPEG-2
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.univision.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.univision.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.338505056.0000000009303000.00000004.00000001.sdmp String found in binary or memory: http://www.videolan.org/x264.html
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.walmart.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.walmart.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.ya.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www.yam.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www3.fnac.com/
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: sfk_setup.tmp, 00000001.00000003.338505056.0000000009303000.00000004.00000001.sdmp String found in binary or memory: http://x265.org
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&amp;Version=2008-06-26&amp;Operation
Source: sfk_setup.tmp, 00000001.00000002.346006634.00000000056F3000.00000002.00000001.sdmp String found in binary or memory: http://z.about.com/m/a08.ico
Source: spkl.exe String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: spkl.exe String found in binary or memory: https://accounts.google.com/o/oauth2/token
Source: spkl.exe String found in binary or memory: https://api-content.dropbox.com/1/chunked_upload
Source: spkl.exe String found in binary or memory: https://api-content.dropbox.com/1/chunked_upload?
Source: spkl.exe String found in binary or memory: https://api-content.dropbox.com/1/commit_chunked_upload
Source: spkl.exe String found in binary or memory: https://api-content.dropbox.com/1/files/dropbox
Source: spkl.exe String found in binary or memory: https://api-content.dropbox.com/1/files/sandbox
Source: spkl.exe String found in binary or memory: https://api-content.dropbox.com/1/files_put
Source: spkl.exe String found in binary or memory: https://api-content.dropbox.com/1/files_put?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/account/info
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/account/info?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/delta
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/delta?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/fileops/copy
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/fileops/copy?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/fileops/create_folder
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/fileops/create_folder?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/fileops/delete
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/fileops/delete?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/fileops/move
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/fileops/move?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/metadata/dropbox
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/metadata/sandbox
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/oauth/access_token
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/oauth/access_token?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/oauth/request_token
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/oauth/request_token?
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/shares/dropbox
Source: spkl.exe String found in binary or memory: https://api.dropbox.com/1/shares/sandbox
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp, spkl.exe String found in binary or memory: https://dashboard.spyrix.com
Source: spkl.exe String found in binary or memory: https://dashboard.spyrix.com/account/login-from-program?email=
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: https://download.spyrix.com/spm.html
Source: sfk_setup.tmp, 00000001.00000003.338285923.0000000009134000.00000004.00000001.sdmp String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: https://sectigo.com/CPS0C
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: https://spyrix.net
Source: spkl.exe String found in binary or memory: https://spyrix.net/Uwas771wvshs7916gjqg62417/core.php
Source: spkl.exe String found in binary or memory: https://spyrix.net/dashboard/api/subscription/status?
Source: spkl.exe String found in binary or memory: https://spyrix.net/usr/monitor/
Source: sfk_setup.tmp, 00000001.00000003.212148023.0000000003170000.00000004.00000001.sdmp, spkl.exe String found in binary or memory: https://spyrix.net/usr/monitor/access.txt
Source: spkl.exe String found in binary or memory: https://spyrix.net/usr/monitor/iupload.php
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp String found in binary or memory: https://store.mspy.com/affiliate.php?ACCOUNT=BITEXGRO&AFFILIATE=40815&PATH=http%3A%2F%2Fwww.mspy.com
Source: spkl.exe String found in binary or memory: https://www.dropbox.com/1/oauth/authorize?oauth_token=
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/auth/drive
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/auth/userinfo.prof
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/drive/v2/about
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/drive/v2/files
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/drive/v2/files/
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/drive/v2/files?maxResults=1000&q=
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files/
Source: spkl.exe String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files?uploadType=resumable
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown HTTPS traffic detected: 54.39.133.136:443 -> 192.168.2.3:49748 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_0040C946 OpenClipboard, 21_2_0040C946
Contains functionality to read the clipboard data
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_0040C6EE GetClipboardData, 21_2_0040C6EE
Contains functionality to record screenshots
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00434448 GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette, 1_2_00434448
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0045C584 GetKeyboardState, 1_2_0045C584
Installs a raw input device (often for capturing keystrokes)
Source: sfk_setup.tmp, 00000001.00000003.338505056.0000000009303000.00000004.00000001.sdmp Binary or memory string: GetRawInputData

System Summary:

barindex
Uses regedit.exe to modify the Windows registry
Source: unknown Process created: C:\Windows\SysWOW64\regedit.exe 'regedit.exe' /e 'C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid' 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1'
Contains functionality to call native functions
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_0040C5D6 NtdllDefWindowProc_W, 21_2_0040C5D6
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004808CC: CreateFileW,DeviceIoControl,GetLastError,CloseHandle,SetLastError, 1_2_004808CC
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040E538 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 0_2_0040E538
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004B00AC GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 1_2_004B00AC
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\Windows\runkey.exe Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0041201D 0_2_0041201D
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00402260 0_2_00402260
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040D33C 0_2_0040D33C
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0041259C 0_2_0041259C
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00411F58 0_2_00411F58
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004E2284 1_2_004E2284
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004E2D99 1_2_004E2D99
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004736F8 1_2_004736F8
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004AC17C 1_2_004AC17C
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0049E118 1_2_0049E118
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004EA1FC 1_2_004EA1FC
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00402474 1_2_00402474
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0044A72C 1_2_0044A72C
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004FCA0C 1_2_004FCA0C
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00488C40 1_2_00488C40
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004BB20C 1_2_004BB20C
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004EB2B0 1_2_004EB2B0
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004535D0 1_2_004535D0
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004077F8 1_2_004077F8
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00481C84 1_2_00481C84
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700A64 21_3_02700A64
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700A05 21_3_02700A05
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700AF4 21_3_02700AF4
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700ADF 21_3_02700ADF
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700AC2 21_3_02700AC2
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700ACF 21_3_02700ACF
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700AB6 21_3_02700AB6
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700A91 21_3_02700A91
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700A9A 21_3_02700A9A
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700B62 21_3_02700B62
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700B43 21_3_02700B43
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700B4A 21_3_02700B4A
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700B31 21_3_02700B31
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700B3E 21_3_02700B3E
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700B28 21_3_02700B28
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700B0B 21_3_02700B0B
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700BEE 21_3_02700BEE
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700BD0 21_3_02700BD0
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700BC4 21_3_02700BC4
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700BCB 21_3_02700BCB
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700BA4 21_3_02700BA4
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700B95 21_3_02700B95
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700C57 21_3_02700C57
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700C39 21_3_02700C39
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700C2E 21_3_02700C2E
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700CF3 21_3_02700CF3
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700CDA 21_3_02700CDA
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700C8B 21_3_02700C8B
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700D6C 21_3_02700D6C
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700D51 21_3_02700D51
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700D42 21_3_02700D42
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700D11 21_3_02700D11
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700D00 21_3_02700D00
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_027009FB 21_3_027009FB
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_027009E7 21_3_027009E7
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_027009EE 21_3_027009EE
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_027009CA 21_3_027009CA
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700DCF 21_3_02700DCF
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700DB6 21_3_02700DB6
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_3_02700D9A 21_3_02700D9A
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_004082DC 21_2_004082DC
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_004036DC 21_2_004036DC
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00411E10 22_2_00411E10
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00430D90 22_2_00430D90
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_0068A700 22_2_0068A700
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00CC1340 22_2_00CC1340
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00CB40A8 22_2_00CB40A8
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 004ADAE0 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 00487C88 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 00409620 appears 151 times
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 0049EE30 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 004B2E4C appears 37 times
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 00406914 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 0049EB4C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 0040C24C appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: String function: 004B2BC8 appears 49 times
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: String function: 00404C88 appears 36 times
PE file contains executable resources (Code or Archives)
Source: sfk_setup.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: sfk_setup.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-I5RK2.tmp.1.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-I5RK2.tmp.1.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
PE file contains strange resources
Source: sfk_setup.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfk_setup.tmp.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: sfk_setup.tmp.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-I5RK2.tmp.1.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-I5RK2.tmp.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: sfk_setup.exe, 00000000.00000003.210347510.00000000026DE000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameshfolder.dll~/ vs sfk_setup.exe
Source: sfk_setup.exe, 00000000.00000002.349265602.0000000002390000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs sfk_setup.exe
Source: sfk_setup.exe, 00000000.00000002.349205642.0000000000A20000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamenetmsg.DLL.MUIj% vs sfk_setup.exe
Tries to load missing DLLs
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Section loaded: ime32.dll Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Section loaded: ime64.dll
Uses 32bit PE files
Source: sfk_setup.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED
Yara signature match
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-6T4M6.tmp, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-98PHS.tmp, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: classification engine Classification label: mal42.evad.winEXE@15/478@2/1
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004328A4 GetLastError,FormatMessageW, 1_2_004328A4
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040E538 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 0_2_0040E538
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004B00AC GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 1_2_004B00AC
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040805C GetDiskFreeSpaceW, 0_2_0040805C
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004CC238 GetVersion,CoCreateInstance, 1_2_004CC238
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040EE14 FindResourceW,SizeofResource,LoadResource,LockResource, 0_2_0040EE14
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\Desktop\sfk_setup.exe File created: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp Jump to behavior
Source: Yara match File source: 00000015.00000003.353294835.0000000003670000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.613741986.0000000000401000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000003.316681311.0000000004810000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.613417816.0000000000401000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.338505056.0000000009303000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-N2S1S.tmp, type: DROPPED
Source: Yara match File source: 21.2.spmm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.spkl.exe.400000.0.unpack, type: UNPACKEDPE
Source: C:\Users\user\Desktop\sfk_setup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;spmm.exe&quot;
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;ff.exe&quot;
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;spm.exe&quot;
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;skl.exe&quot;
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;spkl.exe&quot;
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;sem.exe&quot;
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;clv.exe&quot;
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;akl.exe&quot;
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where Name=&quot;sps.exe&quot;
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\sfk_setup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: sfk_setup.exe Virustotal: Detection: 28%
Source: sfk_setup.exe ReversingLabs: Detection: 25%
Source: sfk_setup.exe String found in binary or memory: rting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked the co
Source: spkl.exe String found in binary or memory: NATS-SEFI-ADD
Source: spkl.exe String found in binary or memory: NATS-DANO-ADD
Source: spkl.exe String found in binary or memory: JIS_C6229-1984-b-add
Source: spkl.exe String found in binary or memory: jp-ocr-b-add
Source: spkl.exe String found in binary or memory: jp-ocr-hand-add
Source: spkl.exe String found in binary or memory: JIS_C6229-1984-hand-add
Source: spkl.exe String found in binary or memory: ISO_6937-2-add
Source: spmm.exe String found in binary or memory: NATS-SEFI-ADD
Source: spmm.exe String found in binary or memory: NATS-DANO-ADD
Source: spmm.exe String found in binary or memory: jp-ocr-b-add
Source: spmm.exe String found in binary or memory: JIS_C6229-1984-b-add
Source: spmm.exe String found in binary or memory: jp-ocr-hand-add
Source: spmm.exe String found in binary or memory: JIS_C6229-1984-hand-add
Source: spmm.exe String found in binary or memory: ISO_6937-2-add
Source: C:\Users\user\Desktop\sfk_setup.exe File read: C:\Users\user\Desktop\sfk_setup.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\sfk_setup.exe 'C:\Users\user\Desktop\sfk_setup.exe'
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp 'C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp' /SL5='$2A0068,23551647,152064,C:\Users\user\Desktop\sfk_setup.exe'
Source: unknown Process created: C:\Windows\SysWOW64\regedit.exe 'regedit.exe' /e 'C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid' 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1'
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' http://www.spyrix.com/spyrix-products.php?from=sfk_install
Source: unknown Process created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1844 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe 'C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' 'Spyrix Free Keylogger 11.5.1'
Source: unknown Process created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe 'C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe' exitime64
Source: C:\Users\user\Desktop\sfk_setup.exe Process created: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp 'C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp' /SL5='$2A0068,23551647,152064,C:\Users\user\Desktop\sfk_setup.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process created: C:\Windows\SysWOW64\regedit.exe 'regedit.exe' /e 'C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid' 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' http://www.spyrix.com/spyrix-products.php?from=sfk_install Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1844 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe 'C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' 'Spyrix Free Keylogger 11.5.1' Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe 'C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe' exitime64 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File written: C:\ProgramData\Spyrix Free Keylogger\temp\logger.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Window found: window name: TSelectLanguageForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Automated click: I accept the agreement
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Automated click: Next >
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Automated click: Next >
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: sfk_setup.exe Static PE information: certificate valid
Source: sfk_setup.exe Static file information: File size 24086096 > 1048576
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll
Source: sfk_setup.exe Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Development\OpenSSL\Temp\openssl-1.0.1c-x32\out32dll\libeay32.pdb source: sfk_setup.tmp, 00000001.00000003.318099211.0000000005F17000.00000004.00000001.sdmp
Source: Binary string: C:\Development\OpenSSL\Temp\openssl-1.0.1c-x32\out32dll\libeay32.pdbpS source: sfk_setup.tmp, 00000001.00000003.318099211.0000000005F17000.00000004.00000001.sdmp
Source: Binary string: C:\Development\OpenSSL\Temp\openssl-1.0.1c-x32\out32dll\ssleay32.pdb source: sfk_setup.tmp, 00000001.00000003.321606072.00000000064FA000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004A1A3C LoadLibraryExW,LoadLibraryW,GetProcAddress, 1_2_004A1A3C
PE file contains an invalid checksum
Source: sfk_setup.exe Static PE information: real checksum: 0x1704537 should be:
Source: sfk_setup.tmp.0.dr Static PE information: real checksum: 0x0 should be: 0x12e541
Source: is-I5RK2.tmp.1.dr Static PE information: real checksum: 0x0 should be: 0x138953
Source: _iscrypt.dll.1.dr Static PE information: real checksum: 0x0 should be: 0x89d2
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040D034 push ecx; mov dword ptr [esp], eax 0_2_0040D039
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040E0D0 push 0040E118h; ret 0_2_0040E110
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_004100D8 push 00410140h; ret 0_2_00410138
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00406944 push 00406986h; ret 0_2_0040697E
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040B104 push 0040B2B0h; ret 0_2_0040B2A8
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00406A50 push 00406A88h; ret 0_2_00406A80
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040E250 push 0040E27Ch; ret 0_2_0040E274
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00406A92 push 00406AC0h; ret 0_2_00406AB8
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00406A94 push 00406AC0h; ret 0_2_00406AB8
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_004064A6 push 0040650Dh; ret 0_2_00406505
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_004064A8 push 0040650Dh; ret 0_2_00406505
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_004034A8 push eax; ret 0_2_004034E4
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0041157C push 004115FAh; ret 0_2_004115F2
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_0040DD38 push 0040DD7Bh; ret 0_2_0040DD73
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00411618 push 00411645h; ret 0_2_0041163D
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004FA044 push ecx; mov dword ptr [esp], ecx 1_2_004FA049
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0046E0B0 push ecx; mov dword ptr [esp], edx 1_2_0046E0B4
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00482158 push 0048219Bh; ret 1_2_00482193
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004AC17C push ecx; mov dword ptr [esp], eax 1_2_004AC181
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0044C1F4 push 0044C220h; ret 1_2_0044C218
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0042E1B4 push 0042E1E0h; ret 1_2_0042E1D8
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0047E234 push 0047E28Eh; ret 1_2_0047E286
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0045C2C4 push ecx; mov dword ptr [esp], ecx 1_2_0045C2C8
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0040A2C4 push 0040A306h; ret 1_2_0040A2FE
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004542FC push 00454367h; ret 1_2_0045435F
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0049C374 push ecx; mov dword ptr [esp], ecx 1_2_0049C378
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0040A3D0 push 0040A408h; ret 1_2_0040A400
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0046E404 push ecx; mov dword ptr [esp], edx 1_2_0046E408
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0040A414 push 0040A440h; ret 1_2_0040A438
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004204B0 push 004204FDh; ret 1_2_004204F5
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00438544 push 00438570h; ret 1_2_00438568

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3NLKP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\Windows\runkey.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EUIQT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\Users\user\AppData\Local\Temp\is-9A0F1.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3NTTN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5A3UD.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-K3O8Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-N2S1S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\Users\user\AppData\Local\Temp\is-9A0F1.tmp\_isetup\_iscrypt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-I5RK2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-D44HS.tmp Jump to dropped file
Source: C:\Users\user\Desktop\sfk_setup.exe File created: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-6ADBO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-CIA22.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-SKKKO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-AFJU2.tmp Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3NLKP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EUIQT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3NTTN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5A3UD.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-K3O8Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-N2S1S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-I5RK2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-D44HS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-6ADBO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-CIA22.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-SKKKO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-AFJU2.tmp Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\Windows\runkey.exe Jump to dropped file

Boot Survival:

barindex
Creates an undocumented autostart registry key
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyrix Free Keylogger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyrix Free Keylogger\Spyrix Free Keylogger.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyrix Free Keylogger\Uninstall Spyrix Free Keylogger.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00470AAC GetWindowLongW,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongW,SetWindowLongW,ShowWindow,ShowWindow, 1_2_00470AAC
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004736F8 IsIconic,SetFocus,GetParent,SaveDC,RestoreDC,GetWindowDC,SaveDC,RestoreDC, 1_2_004736F8
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004629EC IsIconic,GetCapture, 1_2_004629EC
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00470A2C IsIconic, 1_2_00470A2C
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00481238 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,MessageBoxW,SetActiveWindow, 1_2_00481238
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0046335C IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement, 1_2_0046335C
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_0042DBCC MonitorFromWindow,MonitorFromWindow,IsIconic,GetWindowPlacement,GetWindowRect, 1_2_0042DBCC
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00463DC8 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongW,GetWindowLongW,GetWindowLongW,ScreenToClient,ScreenToClient, 1_2_00463DC8
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_0040C8A6 IsIconic, 21_2_0040C8A6
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00677000 IsIconic, 22_2_00677000
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_006770F0 GetWindowLongPtrW,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongPtrW,SetWindowLongPtrW,ShowWindow,ShowWindow, 22_2_006770F0
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\sfk_setup.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Contains capabilities to detect virtual machines
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Contains functionality to detect sandboxes (mouse cursor move detection)
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject, 1_2_0047A500
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Window / User API: foregroundWindowGot 499 Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Window / User API: foregroundWindowGot 1164 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3NLKP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\Windows\runkey.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EUIQT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3NTTN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9A0F1.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5A3UD.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-K3O8Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-N2S1S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-I5RK2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-D44HS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Dropped PE file which has not been started: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-CIA22.tmp Jump to dropped file
Found evasive API chain (may stop execution after accessing registry keys)
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Evasive API call chain: RegQueryValue,DecisionNodes,Sleep
Found large amount of non-executed APIs
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe API coverage: 4.2 %
Queries keyboard layouts
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409 Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409 Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00405BEC GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW, 0_2_00405BEC
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004AD294 FindFirstFileW,GetLastError, 1_2_004AD294
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00408174 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW, 1_2_00408174
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004FDF38 FindFirstFileW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose, 1_2_004FDF38
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_004099DC FindFirstFileW, 21_2_004099DC
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_0041491C FindFirstFileW, 21_2_0041491C
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: 21_2_00409474 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW, 21_2_00409474
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00412380 FindFirstFileW,FindClose, 22_2_00412380
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: 22_2_00CC18B0 FindFirstFileW,FindClose, 22_2_00CC18B0
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_00406458 GetSystemInfo, 0_2_00406458
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: sfk_setup.exe, 00000000.00000002.349265602.0000000002390000.00000002.00000001.sdmp, sfk_setup.tmp, 00000001.00000002.343818747.0000000002800000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: sfk_setup.exe, 00000000.00000002.349265602.0000000002390000.00000002.00000001.sdmp, sfk_setup.tmp, 00000001.00000002.343818747.0000000002800000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: sfk_setup.exe, 00000000.00000002.349265602.0000000002390000.00000002.00000001.sdmp, sfk_setup.tmp, 00000001.00000002.343818747.0000000002800000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: sfk_setup.tmp, 00000001.00000003.315724782.0000000005900000.00000004.00000001.sdmp Binary or memory string: @@IdPORT_vmnet
Source: sfk_setup.exe, 00000000.00000002.349265602.0000000002390000.00000002.00000001.sdmp, sfk_setup.tmp, 00000001.00000002.343818747.0000000002800000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe API call chain: ExitProcess graph end node
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004A1A3C LoadLibraryExW,LoadLibraryW,GetProcAddress, 1_2_004A1A3C

HIPS / PFW / Operating System Protection Evasion:

barindex
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004D8F68 ShellExecuteExW,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle, 1_2_004D8F68
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' http://www.spyrix.com/spyrix-products.php?from=sfk_install Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe 'C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' 'Spyrix Free Keylogger 11.5.1' Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Process created: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe 'C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe' exitime64 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_00480E38 InitializeSecurityDescriptor,SetSecurityDescriptorDacl, 1_2_00480E38
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004B8A78 GetVersion,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,AllocateAndInitializeSid,GetLastError,LocalFree, 1_2_004B8A78
Source: sfk_setup.tmp, 00000001.00000003.315724782.0000000005900000.00000004.00000001.sdmp Binary or memory string: @@DOF_PROGMAN

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: GetModuleFileNameW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW, 0_2_00405DE8
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: GetLocaleInfoW, 0_2_0040E640
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: GetLocaleInfoW, 0_2_00408EB4
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: GetLocaleInfoW, 0_2_00408F00
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW, 0_2_00405F23
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: GetModuleFileNameW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW, 1_2_00408370
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW, 1_2_004084AB
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: GetLocaleInfoW, 1_2_004B0DAC
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: GetLocaleInfoW, 1_2_00410FC0
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: GetLocaleInfoW, 1_2_0041100C
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 21_2_00409AC4
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: GetLocaleInfoW,GetLocaleInfoW, 21_2_0040900C
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe Code function: InterlockedCompareExchange,GetLocalTime,GetLocaleInfoW,GetModuleFileNameW, 21_2_0040BED4
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 22_2_00412560
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 22_2_00411580
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 22_2_00CC1A90
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sime64.exe Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 22_2_00CC0AB0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004B3678 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeW,GetLastError,CreateFileW,SetNamedPipeHandleState,CreateProcessW,CloseHandle,CloseHandle, 1_2_004B3678
Source: C:\Users\user\AppData\Local\Temp\is-MG0AC.tmp\sfk_setup.tmp Code function: 1_2_004B2868 GetSystemTimeAsFileTime,FileTimeToSystemTime, 1_2_004B2868
Source: C:\Users\user\Desktop\sfk_setup.exe Code function: 0_2_004110C4 GetModuleHandleW,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy, 0_2_004110C4
Source: C:\ProgramData\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 338143 Sample: sfk_setup.exe Startdate: 11/01/2021 Architecture: WINDOWS Score: 42 50 Multi AV Scanner detection for submitted file 2->50 52 Uses regedit.exe to modify the Windows registry 2->52 8 sfk_setup.exe 2 2->8         started        process3 file4 30 C:\Users\user\AppData\Local\...\sfk_setup.tmp, PE32 8->30 dropped 11 sfk_setup.tmp 23 500 8->11         started        process5 file6 32 C:\Windows\runkey.exe, PE32 11->32 dropped 34 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 11->34 dropped 36 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 11->36 dropped 38 12 other files (none is malicious) 11->38 dropped 54 Creates an undocumented autostart registry key 11->54 15 regedit.exe 11->15         started        18 iexplore.exe 2 85 11->18         started        21 spkl.exe 1 16 11->21         started        signatures7 process8 dnsIp9 40 C:\ProgramData\...\info.uid, Little-endian 15->40 dropped 42 www.spyrix.com 18->42 44 spyrix.com 18->44 23 iexplore.exe 18->23         started        26 spmm.exe 21->26         started        28 sime64.exe 21->28         started        file10 process11 dnsIp12 46 spyrix.com 54.39.133.136, 443, 49746, 49747 OVHFR Canada 23->46 48 www.spyrix.com 23->48
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.39.133.136
 unknown Canada
16276 OVHFR false

Contacted Domains

Name IP Active
spyrix.com 54.39.133.136 true
www.spyrix.com unknown unknown