Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report SecuriteInfo.com.Variant.Graftor.981190.24096.exe

Overview

General Information

Sample Name:SecuriteInfo.com.Variant.Graftor.981190.24096.exe
Analysis ID:451828
MD5:19cac1ee3a6e5e9f83054616f5d5ce6f
SHA1:5b7f16098760f887b0bdc5fee9223d022e0597fb
SHA256:3709110cc04e0eaffe10bec5e8a5c82b858bee4195975e7bcd30c50b246f56c3
Tags:exe
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
GuLoader behavior detected
Multi AV Scanner detection for submitted file
Yara detected Generic Dropper
Yara detected GuLoader
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
PE / OLE file has an invalid certificate
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://kinmirai.org/wp-content/bin_lOulvHP91.bip"}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
SecuriteInfo.com.Variant.Graftor.981190.24096.exeJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000001.00000000.647926510.0000000000401000.00000020.00020000.sdmpJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
      00000001.00000002.745251859.0000000000401000.00000020.00020000.sdmpJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
        00000001.00000002.750130399.0000000002140000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
          00000008.00000000.743106384.0000000000401000.00000020.00020000.sdmpJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
            Process Memory Space: SecuriteInfo.com.Variant.Graftor.981190.24096.exe PID: 2212JoeSecurity_GenericDropperYara detected Generic DropperJoe Security

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              1.0.SecuriteInfo.com.Variant.Graftor.981190.24096.exe.400000.0.unpackJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
                1.2.SecuriteInfo.com.Variant.Graftor.981190.24096.exe.400000.0.unpackJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
                  8.0.SecuriteInfo.com.Variant.Graftor.981190.24096.exe.400000.0.unpackJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security

                    Sigma Overview

                    No Sigma rule has matched

                    Jbx Signature Overview

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection:

                    barindex
                    Found malware configurationShow sources
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeMalware Configuration Extractor: GuLoader {"Payload URL": "https://kinmirai.org/wp-content/bin_lOulvHP91.bip"}
                    Multi AV Scanner detection for submitted fileShow sources
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeVirustotal: Detection: 14%Perma Link
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeReversingLabs: Detection: 19%
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                    Source: unknownHTTPS traffic detected: 133.130.104.18:443 -> 192.168.2.4:49756 version: TLS 1.2
                    Source: Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\typo.pdb source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                    Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1734370574.000000001E370000.00000040.00000001.sdmp
                    Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe

                    Networking:

                    barindex
                    C2 URLs / IPs found in malware configurationShow sources
                    Source: Malware configuration extractorURLs: https://kinmirai.org/wp-content/bin_lOulvHP91.bip
                    Source: Joe Sandbox ViewASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP
                    Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
                    Source: unknownDNS traffic detected: queries for: kinmirai.org
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://ocsp.digicert.com0C
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://ocsp.digicert.com0O
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: http://www.digicert.com/CPS0
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeString found in binary or memory: https://www.digicert.com/CPS0
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
                    Source: unknownHTTPS traffic detected: 133.130.104.18:443 -> 192.168.2.4:49756 version: TLS 1.2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess Stats: CPU usage > 98%
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148605 NtWriteVirtualMemory,NtProtectVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148B51 NtSetInformationThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02146D5C NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140947 NtWriteVirtualMemory,TerminateProcess,LoadLibraryA,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021453F6 NtAllocateVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02142407 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143437 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214444B NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214207C NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148C81 NtSetInformationThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143EB2 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021440EF NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214293F NtWriteVirtualMemory,LoadLibraryA,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148B5E NtSetInformationThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02144345 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02145541 NtAllocateVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02142567 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FA8 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FC2 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021447FF NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FE9 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9660 NtAllocateVirtualMemory,LdrInitializeThunk,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D96E0 NtFreeVirtualMemory,LdrInitializeThunk,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9860 NtQuerySystemInformation,LdrInitializeThunk,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9610 NtEnumerateValueKey,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9670 NtQueryInformationProcess,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9650 NtQueryValueKey,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D96D0 NtCreateKey,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9730 NtQueryVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3DA710 NtOpenProcessToken,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9710 NtQueryInformationToken,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3DA770 NtOpenThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9770 NtSetInformationFile,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9760 NtOpenProcess,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D97A0 NtUnmapViewOfSection,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9780 NtMapViewOfSection,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9FE0 NtCreateMutant,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3DAD30 NtSetContextThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9520 NtWaitForSingleObject,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9560 NtWriteFile,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9540 NtReadFile,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D95F0 NtQueryInformationFile,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D95D0 NtClose,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9A20 NtResumeThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9A10 NtQuerySection,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9A00 NtProtectVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9A50 NtCreateFile,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9A80 NtOpenDirectoryObject,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9B00 NtSetValueKey,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3DA3B0 NtGetContextThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9820 NtEnumerateKey,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3DB040 NtSuspendThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9840 NtDelayExecution,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D98A0 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D98F0 NtReadVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9910 NtAdjustPrivilegesToken,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D9950 NtQueueApcThread,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D99A0 NtCreateSection,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D99D0 NtCreateProcessEx,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148605
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021404C0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148B51
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02146D5C
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140947
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021451A4
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021453F6
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02142407
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143437
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140626
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02147229
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140E5C
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02145844
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02142A43
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214824D
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214104E
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214444B
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214207C
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140E9A
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148C81
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021438B4
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02147EB4
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02147CB7
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143EB2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140ABB
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021458D6
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021406D2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143EC0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021426CA
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02147AF5
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021406E2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021440EF
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02141706
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214770F
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214093C
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214293F
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02141B24
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02141B2E
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148B5E
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140D5A
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02144345
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02146F73
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214357C
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02142567
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214118E
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021475BE
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021475BB
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021437A5
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021409AE
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FA8
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021405D8
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021421DB
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021411C6
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FC2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021447FF
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143BE2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021401E9
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FE9
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B6E30
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45D616
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E462EF7
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E461FF1
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45D466
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A841F
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E461D55
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E390D20
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E462D07
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4625DD
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2581
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AD5E0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4622AE
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E462B28
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CEBB0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45DBD2
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451002
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E46E824
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C20A0
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AB090
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4628EC
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4620A8
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B4120
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39F900
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: String function: 1E39B150 appears 35 times
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeStatic PE information: invalid certificate
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000001.00000002.746113951.0000000000435000.00000002.00020000.sdmpBinary or memory string: OriginalFilenametypo.exe vs SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1734938567.000000001E61F000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1734295205.000000001DD90000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000000.743496412.0000000000435000.00000002.00020000.sdmpBinary or memory string: OriginalFilenametypo.exe vs SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1734330843.000000001DEE0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeBinary or memory string: OriginalFilenametypo.exe vs SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                    Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/0@1/1
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeFile created: C:\Users\user\AppData\Local\Temp\~DF417CDC9232525881.TMPJump to behavior
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeVirustotal: Detection: 14%
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeReversingLabs: Detection: 19%
                    Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe'
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe'
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe'
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                    Source: Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\typo.pdb source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                    Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1734370574.000000001E370000.00000040.00000001.sdmp
                    Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe

                    Data Obfuscation:

                    barindex
                    Yara detected GuLoaderShow sources
                    Source: Yara matchFile source: 00000001.00000002.750130399.0000000002140000.00000040.00000001.sdmp, type: MEMORY
                    Yara detected GuLoaderShow sources
                    Source: Yara matchFile source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, type: SAMPLE
                    Source: Yara matchFile source: 1.0.SecuriteInfo.com.Variant.Graftor.981190.24096.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SecuriteInfo.com.Variant.Graftor.981190.24096.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.0.SecuriteInfo.com.Variant.Graftor.981190.24096.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000001.00000000.647926510.0000000000401000.00000020.00020000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.745251859.0000000000401000.00000020.00020000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000000.743106384.0000000000401000.00000020.00020000.sdmp, type: MEMORY
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02149656 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214965A push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214964E push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02149676 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02149672 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02149666 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02149662 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214966E push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214966A push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214634A push 00000020h; retf
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FA8 push ebp; retf
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3ED0D1 push ecx; ret
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_00569656 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_0056965A push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_0056964E push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_00569676 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_00569672 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_00569666 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_00569662 push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_0056966E push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_0056966A push esp; iretd
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess information set: NOOPENFILEERRORBOX

                    Malware Analysis System Evasion:

                    barindex
                    Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148605 NtWriteVirtualMemory,NtProtectVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021404C0 EnumWindows,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02146D5C NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140947 NtWriteVirtualMemory,TerminateProcess,LoadLibraryA,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02142407 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143437 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214207C NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02147EB4
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02147CB7 LoadLibraryA,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143EB2 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02140ABB TerminateProcess,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021440EF NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214093C TerminateProcess,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214293F NtWriteVirtualMemory,LoadLibraryA,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02144345 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02142567 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021409AE TerminateProcess,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FA8 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021421DB
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FC2 NtWriteVirtualMemory,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143FE9 NtWriteVirtualMemory,
                    Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002140712 second address: 0000000002140712 instructions:
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002146E7B second address: 0000000002146E7B instructions:
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002140D49 second address: 0000000002140DE7 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a xor eax, EB5A589Ch 0x0000000f jmp 00007FB40C97036Eh 0x00000011 test ch, FFFFFFECh 0x00000014 xor eax, BE5B7B4Ah 0x00000019 cmp dx, cx 0x0000001c add eax, 864E8424h 0x00000021 push eax 0x00000022 test dx, ax 0x00000025 mov eax, dword ptr [ebp+00000190h] 0x0000002b fnop 0x0000002d cmp ebx, ebx 0x0000002f push 43F8D37Fh 0x00000034 cmp edx, 081C3CCEh 0x0000003a xor dword ptr [esp], 2E08F881h 0x00000041 cmp edx, edx 0x00000043 xor dword ptr [esp], 8C9FD1FFh 0x0000004a add dword ptr [esp], 1E90062Fh 0x00000051 push dword ptr [ebp+0000009Ch] 0x00000057 push si 0x00000059 mov si, 35EAh 0x0000005d pop si 0x0000005f mov dword ptr [ebp+0000017Eh], edi 0x00000065 mov edi, eax 0x00000067 push edi 0x00000068 mov edi, dword ptr [ebp+0000017Eh] 0x0000006e pushad 0x0000006f lfence 0x00000072 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002144E1F second address: 0000000002144E1F instructions:
                    Tries to detect Any.runShow sources
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeFile opened: C:\Program Files\qga\qga.exe
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeFile opened: C:\Program Files\qga\qga.exe
                    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000001.00000002.750181825.0000000002150000.00000004.00000001.sdmpBinary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEMSI.DLLPUBLISHERSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSVBVM60.DLL
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000001.00000002.750181825.0000000002150000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
                    Tries to detect virtualization through RDTSC time measurementsShow sources
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002147535 second address: 0000000002147535 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, 702F7768h 0x00000013 xor eax, BAD33913h 0x00000018 xor eax, 29F9B82Ah 0x0000001d add eax, 1CFA09B0h 0x00000022 cpuid 0x00000024 bt ecx, 1Fh 0x00000028 jc 00007FB40C9709A3h 0x0000002e cmp dx, bx 0x00000031 cmp ecx, edx 0x00000033 popad 0x00000034 jmp 00007FB40C97036Ah 0x00000036 test al, al 0x00000038 call 00007FB40C970463h 0x0000003d lfence 0x00000040 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 00000000021406EB second address: 0000000002140712 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 push ebx 0x00000004 mov ebx, dword ptr [ebp+0000027Bh] 0x0000000a mov dword ptr [ebp+00000235h], edi 0x00000010 mov edi, D6C95C11h 0x00000015 cmp cx, FCD6h 0x0000001a xor edi, E9377D93h 0x00000020 xor edi, 468CFA5Dh 0x00000026 pushad 0x00000027 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002140712 second address: 0000000002140712 instructions:
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002146E7B second address: 0000000002146E7B instructions:
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 00000000021453D5 second address: 00000000021453F2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b test edx, ebx 0x0000000d push dword ptr fs:[000000C0h] 0x00000014 pop dword ptr [ebp+48h] 0x00000017 pushad 0x00000018 mov ecx, 000000C1h 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002140D2F second address: 0000000002140D49 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp bx, ax 0x0000000e mov dword ptr [ebp+00000190h], eax 0x00000014 mov eax, 2CB05809h 0x00000019 pushad 0x0000001a rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002140D49 second address: 0000000002140DE7 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a xor eax, EB5A589Ch 0x0000000f jmp 00007FB40C97036Eh 0x00000011 test ch, FFFFFFECh 0x00000014 xor eax, BE5B7B4Ah 0x00000019 cmp dx, cx 0x0000001c add eax, 864E8424h 0x00000021 push eax 0x00000022 test dx, ax 0x00000025 mov eax, dword ptr [ebp+00000190h] 0x0000002b fnop 0x0000002d cmp ebx, ebx 0x0000002f push 43F8D37Fh 0x00000034 cmp edx, 081C3CCEh 0x0000003a xor dword ptr [esp], 2E08F881h 0x00000041 cmp edx, edx 0x00000043 xor dword ptr [esp], 8C9FD1FFh 0x0000004a add dword ptr [esp], 1E90062Fh 0x00000051 push dword ptr [ebp+0000009Ch] 0x00000057 push si 0x00000059 mov si, 35EAh 0x0000005d pop si 0x0000005f mov dword ptr [ebp+0000017Eh], edi 0x00000065 mov edi, eax 0x00000067 push edi 0x00000068 mov edi, dword ptr [ebp+0000017Eh] 0x0000006e pushad 0x0000006f lfence 0x00000072 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000002144E1F second address: 0000000002144E1F instructions:
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 00000000021443C4 second address: 000000000214441B instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b add dword ptr [edi+0Ch], AA027753h 0x00000012 test ch, ch 0x00000014 mov dword ptr [edi+10h], C4A9BE9Bh 0x0000001b test edx, ecx 0x0000001d xor dword ptr [edi+10h], 81B5164Fh 0x00000024 xor dword ptr [edi+10h], 1A4BFCCEh 0x0000002b cmp dl, bl 0x0000002d add dword ptr [edi+10h], A0A8ABE6h 0x00000034 mov dword ptr [edi+14h], 2AEEC3BEh 0x0000003b sub dword ptr [edi+14h], 174CCDEEh 0x00000042 test dh, FFFFFFBAh 0x00000045 xor dword ptr [edi+14h], C024DED6h 0x0000004c xor dword ptr [edi+14h], D3852B06h 0x00000053 pushad 0x00000054 lfence 0x00000057 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000000567535 second address: 0000000000567535 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, 702F7768h 0x00000013 xor eax, BAD33913h 0x00000018 xor eax, 29F9B82Ah 0x0000001d add eax, 1CFA09B0h 0x00000022 cpuid 0x00000024 bt ecx, 1Fh 0x00000028 jc 00007FB40C366B33h 0x0000002e cmp dx, bx 0x00000031 cmp ecx, edx 0x00000033 popad 0x00000034 jmp 00007FB40C3664FAh 0x00000036 test al, al 0x00000038 call 00007FB40C3665F3h 0x0000003d lfence 0x00000040 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 00000000005653D5 second address: 00000000005653F2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b test edx, ebx 0x0000000d push dword ptr fs:[000000C0h] 0x00000014 pop dword ptr [ebp+48h] 0x00000017 pushad 0x00000018 mov ecx, 000000C1h 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000000560D2F second address: 0000000000560DE7 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp bx, ax 0x0000000e mov dword ptr [ebp+00000190h], eax 0x00000014 mov eax, 2CB05809h 0x00000019 pushad 0x0000001a nop 0x0000001b nop 0x0000001c mov eax, 00000001h 0x00000021 cpuid 0x00000023 popad 0x00000024 xor eax, EB5A589Ch 0x00000029 jmp 00007FB40C3664FEh 0x0000002b test ch, FFFFFFECh 0x0000002e xor eax, BE5B7B4Ah 0x00000033 cmp dx, cx 0x00000036 add eax, 864E8424h 0x0000003b push eax 0x0000003c test dx, ax 0x0000003f mov eax, dword ptr [ebp+00000190h] 0x00000045 fnop 0x00000047 cmp ebx, ebx 0x00000049 push 43F8D37Fh 0x0000004e cmp edx, 081C3CCEh 0x00000054 xor dword ptr [esp], 2E08F881h 0x0000005b cmp edx, edx 0x0000005d xor dword ptr [esp], 8C9FD1FFh 0x00000064 add dword ptr [esp], 1E90062Fh 0x0000006b push dword ptr [ebp+0000009Ch] 0x00000071 push si 0x00000073 mov si, 35EAh 0x00000077 pop si 0x00000079 mov dword ptr [ebp+0000017Eh], edi 0x0000007f mov edi, eax 0x00000081 push edi 0x00000082 mov edi, dword ptr [ebp+0000017Eh] 0x00000088 pushad 0x00000089 lfence 0x0000008c rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 000000000056371B second address: 000000000056375D instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 mov ebx, 987026F4h 0x00000008 test ch, ah 0x0000000a xor ebx, 1D32BE7Dh 0x00000010 cmp ch, dh 0x00000012 xor ebx, D33786A7h 0x00000018 test ecx, edx 0x0000001a add ebx, A98AE1E3h 0x00000020 push ebx 0x00000021 test bx, bx 0x00000024 mov ebx, dword ptr [ebp+000001A0h] 0x0000002a mov dword ptr [ebp+000001C7h], ebx 0x00000030 mov ebx, eax 0x00000032 push ebx 0x00000033 mov ebx, dword ptr [ebp+000001C7h] 0x00000039 test cx, ax 0x0000003c pushad 0x0000003d mov ecx, 0000001Fh 0x00000042 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeRDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148605 rdtsc
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000001.00000002.750181825.0000000002150000.00000004.00000001.sdmpBinary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exeMsi.dllPublishershell32advapi32TEMP=windir=\syswow64\msvbvm60.dll
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000001.00000002.750181825.0000000002150000.00000004.00000001.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess information queried: ProcessInformation

                    Anti Debugging:

                    barindex
                    Hides threads from debuggersShow sources
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeThread information set: HideFromDebugger
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeThread information set: HideFromDebugger
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeThread information set: HideFromDebugger
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess queried: DebugPort
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess queried: DebugPort
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess queried: DebugPort
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02148605 rdtsc
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02145FFA LdrInitializeThunk,
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143437 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02145022 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02147CB7 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_021470BE mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02146B34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_0214293F mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02143147 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45AE44 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45AE44 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39E620 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CA61C mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CA61C mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39C600 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39C600 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39C600 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C8E00 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451608 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A766D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E44FE3F mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E44FEC0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E468ED6 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42FE87 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A76E2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C16E0 mov ecx, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E460EA5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E460EA5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E460EA5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4146A7 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C36CC mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D8EC7 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CE730 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E394F2E mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E394F2E mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E468F6A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BF716 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CA70E mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CA70E mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E46070D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E46070D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42FF10 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42FF10 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AFF60 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AEF40 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A8794 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D37F5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E417794 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E417794 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E417794 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CBC2C mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42C450 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42C450 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E451C06 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E46740D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E46740D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E46740D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416C0A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416C0A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416C0A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416C0A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B746D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CA44B mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E468CD6 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A849B mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416CF0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416CF0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416CF0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4514FB mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E413540 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C4D3B mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C4D3B mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C4D3B mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39AD30 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BC577 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BC577 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B7D50 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E468D34 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E41A537 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45E539 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D3D43 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416DC9 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416DC9 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416DC9 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416DC9 mov ecx, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416DC9 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E416DC9 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C1DB5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C1DB5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C1DB5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C35A1 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CFD9B mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CFD9B mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45FDE2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45FDE2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45FDE2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45FDE2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E392D8A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E392D8A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E392D8A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E392D8A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E392D8A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E448DF1 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2581 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2581 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2581 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2581 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AD5E0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AD5E0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4605AC mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4605AC mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45EA55 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D4A2C mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D4A2C mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E424257 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E44B260 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E44B260 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E468A62 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B3A1C mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E395210 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E395210 mov ecx, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E395210 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E395210 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39AA16 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39AA16 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A8A0A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D927A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45AA16 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45AA16 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E399240 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E399240 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E399240 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E399240 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AAAB0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AAAB0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CFAB0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3952A5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3952A5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3952A5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3952A5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3952A5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CD294 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CD294 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2AE4 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2ACB mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E468B58 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C3B7A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C3B7A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39DB60 mov ecx, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45131B mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39F358 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39DB40 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4153CA mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4153CA mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C4BAD mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C4BAD mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C4BAD mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2397 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CB390 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A1B8F mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3A1B8F mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E44D380 mov ecx, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E45138A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BDBE9 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E465BA5 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AB02A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AB02A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AB02A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3AB02A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C002D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C002D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C002D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C002D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C002D mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E461074 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E452073 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E464015 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E464015 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E417016 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E417016 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E417016 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B0050 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B0050 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CF0BF mov ecx, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CF0BF mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CF0BF mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3D90AF mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42B8D0 mov ecx, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E399080 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E413884 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E413884 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3958EC mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C513A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C513A mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B4120 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B4120 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B4120 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B4120 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3B4120 mov ecx, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E399100 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E399100 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E399100 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39B171 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39B171 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39C962 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BB944 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BB944 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C61A0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C61A0 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4241E8 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3C2990 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3BC182 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E3CA185 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39B1E1 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39B1E1 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E39B1E1 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4169A6 mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4151BE mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4151BE mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4151BE mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 8_2_1E4151BE mov eax, dword ptr fs:[00000030h]
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe'
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1729876173.0000000000E70000.00000002.00000001.sdmpBinary or memory string: Program Manager
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1729876173.0000000000E70000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1729876173.0000000000E70000.00000002.00000001.sdmpBinary or memory string: Progman
                    Source: SecuriteInfo.com.Variant.Graftor.981190.24096.exe, 00000008.00000002.1729876173.0000000000E70000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                    Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exeCode function: 1_2_02146E24 cpuid

                    Stealing of Sensitive Information:

                    barindex
                    GuLoader behavior detectedShow sources
                    Source: Initial fileSignature Results: GuLoader behavior
                    Yara detected Generic DropperShow sources
                    Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Variant.Graftor.981190.24096.exe PID: 2212, type: MEMORY

                    Mitre Att&ck Matrix

                    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection12Virtualization/Sandbox Evasion21OS Credential DumpingSecurity Software Discovery621Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel12Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection12LSASS MemoryVirtualization/Sandbox Evasion21Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Deobfuscate/Decode Files or Information1Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol12Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information2NTDSSystem Information Discovery311Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsRemote System Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    SecuriteInfo.com.Variant.Graftor.981190.24096.exe15%VirustotalBrowse
                    SecuriteInfo.com.Variant.Graftor.981190.24096.exe20%ReversingLabsWin32.Trojan.Graftor

                    Dropped Files

                    No Antivirus matches

                    Unpacked PE Files

                    No Antivirus matches

                    Domains

                    No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    https://kinmirai.org/wp-content/bin_lOulvHP91.bip0%VirustotalBrowse
                    https://kinmirai.org/wp-content/bin_lOulvHP91.bip0%Avira URL Cloudsafe

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    kinmirai.org
                    		133.130.104.18
                    		truetrue
                      		unknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://kinmirai.org/wp-content/bin_lOulvHP91.biptrue
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown

                      Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public

                      IPDomainCountryFlagASNASN NameMalicious
                      133.130.104.18
                      		kinmirai.orgJapan7506INTERQGMOInternetIncJPtrue

                      General Information

                      Joe Sandbox Version:33.0.0 White Diamond
                      Analysis ID:451828
                      Start date:21.07.2021
                      Start time:12:10:46
                      Joe Sandbox Product:CloudBasic
                      Overall analysis duration:0h 13m 22s
                      Hypervisor based Inspection enabled:false
                      Report type:light
                      Sample file name:SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                      Run name:Suspected Instruction Hammering Hide Perf
                      Number of analysed new started processes analysed:29
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • HDC enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Detection:MAL
                      Classification:mal100.troj.spyw.evad.winEXE@3/0@1/1
                      EGA Information:Failed
                      HDC Information:
                      • Successful, ratio: 96% (good quality ratio 83.5%)
                      • Quality average: 71.6%
                      • Quality standard deviation: 33.5%
                      HCA Information:Failed
                      Cookbook Comments:
                      • Adjust boot time
                      • Enable AMSI
                      • Found application associated with file extension: .exe
                      Warnings:
                      Show All
                      • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, RuntimeBroker.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                      • TCP Packets have been reduced to 100
                      • Excluded IPs from analysis (whitelisted): 104.43.193.48, 52.147.198.201, 23.54.113.53, 104.42.151.234, 20.82.210.154, 20.54.110.249, 205.185.216.42, 205.185.216.10, 40.112.88.60, 23.10.249.43, 23.10.249.26, 20.50.102.62, 20.190.160.135, 20.190.160.5, 20.190.160.70, 20.190.160.131, 20.190.160.9, 20.190.160.74, 20.190.160.68, 20.190.160.7, 40.127.240.158, 51.104.136.2
                      • Excluded domains from analysis (whitelisted): www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, cds.d2s7q6s2.hwcdn.net, www.tm.a.prd.aadg.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, skypedataprdcolcus15.cloudapp.net, settingsfd-geo.trafficmanager.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.

                      Simulations

                      Behavior and APIs

                      No simulations

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                      133.130.104.18F63V4i8eZU.exeGet hashmaliciousBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        kinmirai.orgF63V4i8eZU.exeGet hashmaliciousBrowse
                        • 133.130.104.18

                        ASN

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        INTERQGMOInternetIncJPPO20210719.docxGet hashmaliciousBrowse
                        • 157.7.107.89
                        F63V4i8eZU.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        Y-20211907-00927735_pdf.exeGet hashmaliciousBrowse
                        • 118.27.99.20
                        kung.xlsxGet hashmaliciousBrowse
                        • 163.44.185.218
                        Tlz3P6ra10.exeGet hashmaliciousBrowse
                        • 163.44.239.73
                        LcpQGVWUWU.exeGet hashmaliciousBrowse
                        • 163.44.185.221
                        01_extracted.exeGet hashmaliciousBrowse
                        • 150.95.255.38
                        Order_1537-25.exeGet hashmaliciousBrowse
                        • 150.95.255.38
                        Enquiry#List For Urgent Order070421.exeGet hashmaliciousBrowse
                        • 118.27.99.88
                        New Order062421.exeGet hashmaliciousBrowse
                        • 150.95.255.38
                        ZQGMiyaTir.exeGet hashmaliciousBrowse
                        • 163.44.239.73
                        Shipping Document DHL.exeGet hashmaliciousBrowse
                        • 150.95.255.38
                        xwKdahKPn8.exeGet hashmaliciousBrowse
                        • 210.172.144.245
                        kXkTaGocR5.exeGet hashmaliciousBrowse
                        • 163.44.239.73
                        heoN5wnP2d.exeGet hashmaliciousBrowse
                        • 163.44.239.73
                        New Order_PO 1164_HD-F 4020 6K.exeGet hashmaliciousBrowse
                        • 118.27.99.88
                        Potvrda o uplati u eurima.exeGet hashmaliciousBrowse
                        • 163.44.187.215
                        June 21st,2021.exeGet hashmaliciousBrowse
                        • 157.7.107.169
                        eTWZtFRRMJ.exeGet hashmaliciousBrowse
                        • 163.44.239.73
                        New Order_PO 1164_HD-F 4020 6K.exeGet hashmaliciousBrowse
                        • 118.27.99.88

                        JA3 Fingerprints

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        37f463bf4616ecd445d4a1937da06e19IPVrDRKfYj.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        11.docxGet hashmaliciousBrowse
                        • 133.130.104.18
                        #U2706_#U260e_Play _to _Listen.htmGet hashmaliciousBrowse
                        • 133.130.104.18
                        Wcqwghjdefrkaiamzhtbgtpbmolvfnoxik.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        Wcqwghjdefrkaiamzhtbgtpbmolvfnoxik.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        BoFA Remittance Advice-2021207.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        8rbuJ8Ycv1.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        DRQxZrK.dllGet hashmaliciousBrowse
                        • 133.130.104.18
                        DRQxZrK.dllGet hashmaliciousBrowse
                        • 133.130.104.18
                        lpaBPnb1OB.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        nZdwtTEYoW.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        unJLhL75HG.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        9bCnBwR693.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        BVD1xWp0y0.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        nRjbMQ5Jua.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        Hsbc Scan copy 3547856788 Pdf.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        DigitalLicense.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        vir.dllGet hashmaliciousBrowse
                        • 133.130.104.18
                        #Ud53c#Uc544#Ub178.exeGet hashmaliciousBrowse
                        • 133.130.104.18
                        Wesnvuotnnnxvacefgejmjccyfnnrjmdmc.exeGet hashmaliciousBrowse
                        • 133.130.104.18

                        Dropped Files

                        No context

                        Created / dropped Files

                        No created / dropped files found

                        Static File Info

                        General

                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                        Entropy (8bit):4.635501230509535
                        TrID:
                        • Win32 Executable (generic) a (10002005/4) 99.15%
                        • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
                        • Generic Win/DOS Executable (2004/3) 0.02%
                        • DOS Executable Generic (2002/1) 0.02%
                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                        File name:SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                        File size:246888
                        MD5:19cac1ee3a6e5e9f83054616f5d5ce6f
                        SHA1:5b7f16098760f887b0bdc5fee9223d022e0597fb
                        SHA256:3709110cc04e0eaffe10bec5e8a5c82b858bee4195975e7bcd30c50b246f56c3
                        SHA512:75d7cc20b44224ab616b9d4e6edd2c527c4245f5752430a08ed7a68a3d1596bfe5f9a16a447a57e8cbbe965b7377c6259f481c6a1ae8d262238ad25dce14a0ad
                        SSDEEP:3072:MtU2Qf98DH332/jEvQuUZZNzPmhd3QPBP:KU2Qf9iXm/jduUNzPKNC
                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................................Rich............PE..L.....QU.................0...p......0........@....@................

                        File Icon

                        Icon Hash:e8ccce8e8ececce8

                        Static PE Info

                        General

                        Entrypoint:0x401330
                        Entrypoint Section:.text
                        Digitally signed:true
                        Imagebase:0x400000
                        Subsystem:windows gui
                        Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                        DLL Characteristics:
                        Time Stamp:0x5551E11C [Tue May 12 11:16:44 2015 UTC]
                        TLS Callbacks:
                        CLR (.Net) Version:
                        OS Version Major:4
                        OS Version Minor:0
                        File Version Major:4
                        File Version Minor:0
                        Subsystem Version Major:4
                        Subsystem Version Minor:0
                        Import Hash:4e1e57f6de47f654992269152dd1e659

                        Authenticode Signature

                        Signature Valid:false
                        Signature Issuer:E=Lertj1@impifo.Tw, CN=Konc, OU=HVEPSERED, O=Sulfur2, L=Delings, S=tyskla, C=IS
                        Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                        Error Number:-2146762487
                        Not Before, Not After
                        • 7/20/2021 11:04:04 PM 7/20/2022 11:04:04 PM
                        Subject Chain
                        • E=Lertj1@impifo.Tw, CN=Konc, OU=HVEPSERED, O=Sulfur2, L=Delings, S=tyskla, C=IS
                        Version:3
                        Thumbprint MD5:E001EFB7FC2CF4F9AF90A05F56C0FF24
                        Thumbprint SHA-1:FCE4066FC44A76DB5BD40EDCD674457947994F61
                        Thumbprint SHA-256:30E21C2F0117B69F54088BA86D9ACD07DCB63504497576DBD473335F67BB6F5D
                        Serial:00

                        Entrypoint Preview

                        Instruction
                        push 0042F010h
                        call 00007FB40C9DE763h
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        xor byte ptr [eax], al
                        add byte ptr [eax], al
                        cmp byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        jnle 00007FB40C9DE722h
                        mov dh, EDh
                        lodsb
                        jl 00007FB40C9DE707h
                        inc ebx
                        mov ecx, BEBDAAA6h
                        insd
                        das
                        out dx, al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add dword ptr [eax], eax
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        dec esp
                        jne 00007FB40C9DE7E0h
                        popad
                        je 00007FB40C9DE7D3h
                        imul eax, dword ptr [eax], 00000000h
                        dec esp
                        xor dword ptr [eax], eax
                        adc al, 59h
                        push esi
                        rcl dword ptr [ebp+eax*4+6Eh], 1
                        add byte ptr [edx+ebx*4-14h], al
                        movsb
                        loope 00007FB40C9DE770h
                        cld
                        outsd
                        clc
                        and eax, 9AF307A8h
                        inc ebp
                        inc ebx
                        inc esp
                        stosb
                        and ecx, ecx
                        push edi
                        cmp byte ptr [ebx+4F3A3B76h], FFFFFFADh
                        xor ebx, dword ptr [ecx-48EE309Ah]
                        or al, 00h
                        stosb
                        add byte ptr [eax-2Dh], ah
                        xchg eax, ebx
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        push es
                        fild dword ptr [edx]
                        add byte ptr [ecx+4Fh], bh
                        add byte ptr [eax], al
                        add byte ptr [eax], cl
                        add byte ptr [edi+ebp*2+74h], ah
                        imul ebp, dword ptr [esi+67h], 0D006373h
                        add dword ptr [eax+eax], eax
                        push edx
                        dec ecx
                        inc edi
                        dec eax
                        add byte ptr [ecx], bl
                        add dword ptr [eax], eax
                        inc edx
                        add byte ptr [edx], ah
                        add byte ptr [ebx], ah
                        dec edi

                        Data Directories

                        NameVirtual AddressVirtual Size Is in Section
                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IMPORT0x330540x28.text
                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x350000x54b4.rsrc
                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                        IMAGE_DIRECTORY_ENTRY_SECURITY0x3b0500x1418
                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                        IMAGE_DIRECTORY_ENTRY_DEBUG0x11000x1c.text
                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
                        IMAGE_DIRECTORY_ENTRY_IAT0x10000xf8.text
                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                        Sections

                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                        .text0x10000x324a00x33000False0.249899471507data4.58227124451IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                        .data0x340000xb900x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                        .rsrc0x350000x54b40x6000False0.293172200521data4.10742387863IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                        Resources

                        NameRVASizeTypeLanguageCountry
                        RT_ICON0x39e4c0x668dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 4265541880, next used block 7936
                        RT_ICON0x39b640x2e8data
                        RT_ICON0x3997c0x1e8data
                        RT_ICON0x398540x128GLS_BINARY_LSB_FIRST
                        RT_ICON0x389ac0xea8data
                        RT_ICON0x381040x8a8data
                        RT_ICON0x37a3c0x6c8data
                        RT_ICON0x374d40x568GLS_BINARY_LSB_FIRST
                        RT_ICON0x3642c0x10a8data
                        RT_ICON0x35aa40x988data
                        RT_ICON0x3563c0x468GLS_BINARY_LSB_FIRST
                        RT_GROUP_ICON0x3559c0xa0data
                        RT_VERSION0x352d00x2ccdataEnglishUnited States

                        Imports

                        DLLImport
                        MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaLateMemCall, __vbaStrToAnsi, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

                        Version Infos

                        DescriptionData
                        Translation0x0409 0x04b0
                        LegalCopyrightClicked
                        InternalNametypo
                        FileVersion7.00
                        CompanyNameClicked
                        LegalTrademarksClicked
                        CommentsClicked
                        ProductNameClicked
                        ProductVersion7.00
                        FileDescriptionClicked
                        OriginalFilenametypo.exe

                        Possible Origin

                        Language of compilation systemCountry where language is spokenMap
                        EnglishUnited States

                        Network Behavior

                        Snort IDS Alerts

                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                        07/21/21-12:03:04.195208ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:08.069840ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:12.026957ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:16.027956ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:16.041189ICMP449ICMP Time-To-Live Exceeded in Transit91.201.58.73192.168.2.6
                        07/21/21-12:03:16.041669ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:16.053598ICMP449ICMP Time-To-Live Exceeded in Transit91.206.52.152192.168.2.6
                        07/21/21-12:03:16.054007ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:20.122673ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:24.028507ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:28.028441ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:32.028747ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:36.030038ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:40.029681ICMP384ICMP PING192.168.2.613.107.4.50
                        07/21/21-12:03:40.042423ICMP408ICMP Echo Reply13.107.4.50192.168.2.6

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Jul 21, 2021 12:13:07.842685938 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:08.080722094 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.080848932 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:08.101291895 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:08.337555885 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.342720985 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.342747927 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.342761993 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.343075037 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:08.429688931 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:08.666393042 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.668899059 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:08.681634903 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:08.919889927 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.919926882 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.919948101 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.919970989 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.919995070 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.920017004 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.920041084 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.920068026 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.920094013 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.920115948 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:08.920248985 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:08.920331001 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.158828020 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.158874989 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.158901930 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.158934116 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.158963919 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.158962011 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.158989906 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.159015894 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.159050941 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.159081936 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.159110069 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.159132004 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.159209967 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.159368038 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.395946026 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396023035 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396048069 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396070004 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396090984 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396239996 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396262884 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396285057 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396300077 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.396306992 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396395922 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396416903 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396436930 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396442890 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.396495104 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.396497965 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396521091 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.396548986 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.396621943 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.632973909 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.633001089 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.633265972 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.634362936 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634385109 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634429932 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634510994 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634578943 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.634676933 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634689093 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.634701014 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634717941 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634733915 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634843111 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.634865046 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634888887 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634891033 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.634918928 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.634959936 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.635000944 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.635018110 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.635036945 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.635047913 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.635056019 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.635072947 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.635088921 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.635144949 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.635221958 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.869800091 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.869832993 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.869846106 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.870045900 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.870631933 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.870661020 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.870678902 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.870695114 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.870712042 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.870774031 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.870812893 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.870855093 CEST49756443192.168.2.4133.130.104.18
                        Jul 21, 2021 12:13:09.870871067 CEST44349756133.130.104.18192.168.2.4
                        Jul 21, 2021 12:13:09.870928049 CEST49756443192.168.2.4133.130.104.18

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Jul 21, 2021 12:11:28.659862995 CEST5802853192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:28.673554897 CEST53580288.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:29.508589983 CEST5309753192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:29.521244049 CEST53530978.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:30.042069912 CEST4925753192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:30.060789108 CEST53492578.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:33.537056923 CEST6238953192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:33.549148083 CEST53623898.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:34.528343916 CEST4991053192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:34.541459084 CEST53499108.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:35.524209976 CEST5585453192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:35.539905071 CEST53558548.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:36.350260019 CEST6454953192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:36.368417025 CEST53645498.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:37.339224100 CEST6315353192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:37.356395006 CEST53631538.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:37.983366966 CEST5299153192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:37.996326923 CEST53529918.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:38.792701006 CEST5370053192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:38.806636095 CEST53537008.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:39.641449928 CEST5172653192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:39.655206919 CEST53517268.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:40.828303099 CEST5679453192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:40.841437101 CEST53567948.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:41.487544060 CEST5653453192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:41.501157045 CEST53565348.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:42.110591888 CEST5662753192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:42.125725031 CEST53566278.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:43.076989889 CEST5662153192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:43.090162992 CEST53566218.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:44.720104933 CEST6311653192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:44.732237101 CEST53631168.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:45.443929911 CEST6407853192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:45.457055092 CEST53640788.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:46.509162903 CEST6480153192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:46.524358034 CEST53648018.8.8.8192.168.2.4
                        Jul 21, 2021 12:11:47.822518110 CEST6172153192.168.2.48.8.8.8
                        Jul 21, 2021 12:11:47.836349010 CEST53617218.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:02.479473114 CEST5125553192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:02.493089914 CEST53512558.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:23.023420095 CEST6152253192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:23.097974062 CEST53615228.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:23.330646038 CEST5233753192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:23.346139908 CEST53523378.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:23.948959112 CEST5504653192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:23.964185953 CEST53550468.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:25.385813951 CEST4961253192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:25.465778112 CEST53496128.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:30.280365944 CEST4928553192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:30.294329882 CEST53492858.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:31.085834026 CEST5060153192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:31.099173069 CEST53506018.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:31.652753115 CEST6087553192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:31.741770029 CEST53608758.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:32.500979900 CEST5644853192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:32.514101982 CEST53564488.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:33.224143028 CEST5917253192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:33.260479927 CEST53591728.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:33.417370081 CEST6242053192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:33.431308985 CEST53624208.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:34.516972065 CEST6057953192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:34.530416965 CEST53605798.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:34.994863987 CEST5018353192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:35.066095114 CEST53501838.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:45.570372105 CEST6153153192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:45.590770960 CEST53615318.8.8.8192.168.2.4
                        Jul 21, 2021 12:12:48.388950109 CEST4922853192.168.2.48.8.8.8
                        Jul 21, 2021 12:12:48.410485983 CEST53492288.8.8.8192.168.2.4
                        Jul 21, 2021 12:13:02.446716070 CEST5979453192.168.2.48.8.8.8
                        Jul 21, 2021 12:13:02.460864067 CEST53597948.8.8.8192.168.2.4
                        Jul 21, 2021 12:13:05.683134079 CEST5591653192.168.2.48.8.8.8
                        Jul 21, 2021 12:13:05.697160006 CEST53559168.8.8.8192.168.2.4
                        Jul 21, 2021 12:13:07.443418026 CEST5275253192.168.2.48.8.8.8
                        Jul 21, 2021 12:13:07.824268103 CEST53527528.8.8.8192.168.2.4
                        Jul 21, 2021 12:16:19.324110031 CEST6054253192.168.2.48.8.8.8
                        Jul 21, 2021 12:16:19.352860928 CEST53605428.8.8.8192.168.2.4
                        Jul 21, 2021 12:16:19.753959894 CEST6068953192.168.2.48.8.8.8
                        Jul 21, 2021 12:16:19.790894032 CEST53606898.8.8.8192.168.2.4
                        Jul 21, 2021 12:16:23.073700905 CEST6420653192.168.2.48.8.8.8
                        Jul 21, 2021 12:16:23.088897943 CEST53642068.8.8.8192.168.2.4
                        Jul 21, 2021 12:16:26.816910982 CEST5090453192.168.2.48.8.8.8
                        Jul 21, 2021 12:16:26.842767000 CEST53509048.8.8.8192.168.2.4
                        Jul 21, 2021 12:16:27.113584042 CEST5752553192.168.2.48.8.8.8
                        Jul 21, 2021 12:16:27.141411066 CEST53575258.8.8.8192.168.2.4
                        Jul 21, 2021 12:18:35.018955946 CEST5381453192.168.2.48.8.8.8
                        Jul 21, 2021 12:18:35.032601118 CEST53538148.8.8.8192.168.2.4

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                        Jul 21, 2021 12:13:07.443418026 CEST192.168.2.48.8.8.80xc036Standard query (0)kinmirai.orgA (IP address)IN (0x0001)

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                        Jul 21, 2021 12:13:07.824268103 CEST8.8.8.8192.168.2.40xc036No error (0)kinmirai.org133.130.104.18A (IP address)IN (0x0001)
                        Jul 21, 2021 12:16:19.352860928 CEST8.8.8.8192.168.2.40x2394No error (0)prda.aadg.msidentity.comwww.tm.a.prd.aadg.akadns.netCNAME (Canonical name)IN (0x0001)

                        HTTPS Packets

                        TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                        Jul 21, 2021 12:13:08.342761993 CEST133.130.104.18443192.168.2.449756CN=www.kinmirai.org CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BECN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3Tue Jun 22 20:42:45 CEST 2021 Tue Jul 28 02:00:00 CEST 2020Mon Jul 26 07:45:48 CEST 2021 Sun Mar 18 01:00:00 CET 2029771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                        CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BECN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3Tue Jul 28 02:00:00 CEST 2020Sun Mar 18 01:00:00 CET 2029

                        Code Manipulations

                        Statistics

                        Behavior

                        Click to jump to process

                        System Behavior

                        Analysis Process: SecuriteInfo.com.Variant.Graftor.981190.24096.exe PID: 6508 Parent PID: 5880

                        General

                        Start time:12:11:34
                        Start date:21/07/2021
                        Path:C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                        Wow64 process (32bit):true
                        Commandline:'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe'
                        Imagebase:0x400000
                        File size:246888 bytes
                        MD5 hash:19CAC1EE3A6E5E9F83054616F5D5CE6F
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:Visual Basic
                        Yara matches:
                        • Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000001.00000000.647926510.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000001.00000002.745251859.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.750130399.0000000002140000.00000040.00000001.sdmp, Author: Joe Security
                        Reputation:low

                        Analysis Process: SecuriteInfo.com.Variant.Graftor.981190.24096.exe PID: 2212 Parent PID: 6508

                        General

                        Start time:12:12:19
                        Start date:21/07/2021
                        Path:C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe
                        Wow64 process (32bit):true
                        Commandline:'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Graftor.981190.24096.exe'
                        Imagebase:0x400000
                        File size:246888 bytes
                        MD5 hash:19CAC1EE3A6E5E9F83054616F5D5CE6F
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000008.00000000.743106384.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
                        Reputation:low

                        Disassembly

                        Code Analysis

                        Reset < >