Play interactive tour

Edit tour

Windows Analysis Report Weemaes B.V.-PO74748392.exe

Overview

General Information

Sample Name:	Weemaes B.V.-PO74748392.exe
Analysis ID:	458358
MD5:	a08f23a15ef10b17370668cf5b9947ad
SHA1:	7cc53628714dd9d69881be1d186adf7b3e7af9cd
SHA256:	cc8e7690934b9059a1613d246a6c933df5dd7b1e333038dc76f7839dcc5697cd
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

GuLoader behavior detected

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Hides threads from debuggers

Potentially malicious time measurement code found

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

PE / OLE file has an invalid certificate

PE file contains strange resources

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Weemaes B.V.-PO74748392.exe (PID: 6728 cmdline: 'C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe' MD5: A08F23A15EF10B17370668CF5B9947AD)

Weemaes B.V.-PO74748392.exe (PID: 5960 cmdline: 'C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe' MD5: A08F23A15EF10B17370668CF5B9947AD)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://rossettlee.ddnsgeek.com/x/5bab0b1d864615bab0b1d864b3/2"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000002.1740602938.0000000000560000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.1006583828.0000000002140000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: Weemaes B.V.-PO74748392.exe

Malware Configuration Extractor: GuLoader {"Payload URL": "http://rossettlee.ddnsgeek.com/x/5bab0b1d864615bab0b1d864b3/2"}

Multi AV Scanner detection for submitted file

Show sources

Source: Weemaes B.V.-PO74748392.exe

Virustotal: Detection: 35%

Perma Link

Source: Weemaes B.V.-PO74748392.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://rossettlee.ddnsgeek.com/x/5bab0b1d864615bab0b1d864b3/2

Source: Weemaes B.V.-PO74748392.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Weemaes B.V.-PO74748392.exe	String found in binary or memory: http://s.symcd.com06
Source: Weemaes B.V.-PO74748392.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Weemaes B.V.-PO74748392.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Weemaes B.V.-PO74748392.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Weemaes B.V.-PO74748392.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: Weemaes B.V.-PO74748392.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: Weemaes B.V.-PO74748392.exe	String found in binary or memory: https://d.symcb.com/rpa0.

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214C733 NtProtectVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214CD46 LoadLibraryA,NtResumeThread,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140D67 NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141190 NtWriteVirtualMemory,TerminateProcess,LoadLibraryA,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147989 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146214 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145E29 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145E51 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146644 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146270 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146672 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214567C NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146A84 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145A86 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147A86 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142682 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145EBE NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147AB9 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146ADE NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021466F6 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145AFA NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021462E2 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147B15 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145F2E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145B56 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147B5A NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214634D NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214674E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146363 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146B69 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145F93 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214679E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147B9F NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021453A1 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145BD3 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021463D8 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145FF6 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021477FF NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146BE3 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A018 NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214800E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A435 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146C52 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146442 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214604A NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214687B NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145C62 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214649B NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145C83 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460B7 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460D0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145CDB NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146CC3 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460E7 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147CE1 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146508 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214653E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146528 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214654C NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A175 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214597F NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145D62 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214796D NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146196 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214698D NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021465AF NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145DDF NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021465C6 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021469F8 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A5EB NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567989 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056796D NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567A86 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567AB9 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567B5A NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567B15 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005677FF NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567B9F NtAllocateVirtualMemory,

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140827
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B51C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214CD46
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140D67
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141190
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147989
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146214
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B212
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B604
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141202
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214D609
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140A32
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214822D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145E29
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143E51
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145E51
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143652
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146644
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146270
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146672
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214567C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145A7D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214127F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141A62
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140A93
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146A84
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B284
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145A86
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142682
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214AEB3
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141ABE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145EBE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144AA2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021412D5
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141ED2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146ADE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021416F4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021466F6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021412F7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145AFA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021462E2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021482EA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144B1F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143F1A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140B07
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142302
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214370D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214570E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02148724
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145F2E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145B56
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02148352
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214AF53
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140B5F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141742
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214634D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144B4E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214674E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214134B
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141B7E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214377E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214577E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214AF66
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140363
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146363
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214136C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146B69
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141F96
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145F93
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214679E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140786
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021453A1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021417AE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021437D7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145BD3
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021463D8
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021413DA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144BC8
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145FF6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143FF7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141FF0
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021477FF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B01E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A018
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140000
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214800E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A80F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A435
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144C32
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214043E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214383A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A850
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146C52
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146442
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214804F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214204A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214144A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214404A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214604A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214147A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214807A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214687B
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141867
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214AC60
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145C62
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143C6C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A86A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140492
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214649B
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145C83
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B08A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460B7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021480AE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021410AF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142CAA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460D0
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145CDB
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B8C4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021418C5
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143CC1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021434CE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141CF2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021414F2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144CE4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460E7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147CE1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142CE9
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214811E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B10E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142D0F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146508
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143D0A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214653E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141D3F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214293A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141926
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214412D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142928
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146528
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141D5C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B15A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145145
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02148146
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214654C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141548
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144D48
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A175
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214597F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143167
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145D62
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143D6C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214796D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146196
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02148192
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214119A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02149D85
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141D86
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214698D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214098A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214298A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021419A7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021465AF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021409D6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142DDC
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145DDF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021465C6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B1C9
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214ADCA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021429F8
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021469F8
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021419FB
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143DE2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A5EB
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567989
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566056
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A850
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056644E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056804F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056204A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056404A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056147A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056807A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056D07A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056AC60
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563C6C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A86A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B01E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A018
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566002
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560000
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056800E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A80F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A435
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564C32
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056043E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056383A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BC3A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560827
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566822
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561828
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005618D6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565CDB
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B8C4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563CC1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005634CE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005614FE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BCFE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005660E7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564CE4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567CE1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562CE9
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560492
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566892
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BC98
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565C83
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B08A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005664A6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005680AE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005610AF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562CAA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561552
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561D5C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B15A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CD46
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00568146
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565145
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564D48
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566548
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A175
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056597F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563167
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560D67
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565D62
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CD62
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563D6C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056796D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056811E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B51C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B10E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562D0F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563D0A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056C50A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056293A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056412D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562928
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562DDC
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CDDA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005665C6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056C1C6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CDC2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056ADCA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B1C9
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005619FB
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005629F8
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565DE6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563DE2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A5EB
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00568192
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561190
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056699E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056119A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CD86
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00569D85
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056298A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B9B2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005615BA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005619A7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CDAE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005665AF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005609AA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BE57
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563652
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563E51
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565E51
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CE46
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566644
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566672
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BE7E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056C27E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056567C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565A7D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561A62
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BA6E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BE6E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B212
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BA1E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B604
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561202
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CE0E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566A0A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056D609
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566233
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565E3A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056C226
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056822D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CE2A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BAD6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005612D5
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561ED2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BEDA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005616F6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005666F6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CEF4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565AFA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056C2EE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566AEA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005682EA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CE96
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561292
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565A86
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566286
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B284
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562682
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561682
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566A8E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056AEB3
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561ABE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565EBE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560AA6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564AA2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565B56
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561355
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00568352
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056AF53
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056635A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BF42
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056174E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564B4E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BB4A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CF4A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561376
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561B7E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056377E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056577E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056AF66
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560363
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056636E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056036F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560B6A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CF10
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564B1F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563F1A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560302
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562302
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560B0E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056570E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056370D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056130A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056630B
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056033F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00568724
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565F2E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CF2A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BB28
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005637D7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BBD2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005663DE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564BC8
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563FF7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561FF0
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005677FF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565BE6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CFE7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005613E2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BBEC
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560396
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561F96
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056CF96
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565F9A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BB9B
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005617BA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005653A1

Source: Weemaes B.V.-PO74748392.exe

Static PE information: invalid certificate

Source: Weemaes B.V.-PO74748392.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Weemaes B.V.-PO74748392.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Weemaes B.V.-PO74748392.exe, 00000000.00000002.1005735854.000000000041D000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePROKURAERS.exe vs Weemaes B.V.-PO74748392.exe
Source: Weemaes B.V.-PO74748392.exe, 00000000.00000002.1006506197.00000000020A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs Weemaes B.V.-PO74748392.exe
Source: Weemaes B.V.-PO74748392.exe, 00000012.00000000.1004881128.000000000041D000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePROKURAERS.exe vs Weemaes B.V.-PO74748392.exe
Source: Weemaes B.V.-PO74748392.exe	Binary or memory string: OriginalFilenamePROKURAERS.exe vs Weemaes B.V.-PO74748392.exe

Source: Weemaes B.V.-PO74748392.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/0@0/0

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

File created: C:\Users\user\AppData\Local\Temp\~DF12BD0338C143CEBC.TMP

Jump to behavior

Source: Weemaes B.V.-PO74748392.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Weemaes B.V.-PO74748392.exe

Virustotal: Detection: 35%

Source: unknown	Process created: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe 'C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe'
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Process created: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe 'C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe'
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Process created: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe 'C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe'

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000012.00000002.1740602938.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1006583828.0000000002140000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_004079B4 push edi; retf
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144442 push edx; ret
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144469 push edx; ret
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021424A2 push F7664D43h; ret
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021410AF pushad ; ret
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564442 push edx; ret
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564469 push edx; ret
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00569CFD push esp; ret
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005624A2 push F7664D43h; ret
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056C1BE push CA38C084h; retn 001Ch

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B51C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140D67 NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141190 NtWriteVirtualMemory,TerminateProcess,LoadLibraryA,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146214 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214D609
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214423A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145E29 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143E51
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145E51 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146270 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214567C NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145A86 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142682 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145EBE NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021442A2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144AA2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145AFA NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021462E2 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214231C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144B1F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143F1A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142302
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214430E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214473D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02148724
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145F2E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145B56 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144B4E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214476E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144396
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145F93 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02140786 EnumWindows,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021447BE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021453A1 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021447AD
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145BD3 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145FF6 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143FF7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144816
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A018 NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214800E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A435 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214804F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214404A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214604A NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214487E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214807A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145C62 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143C6C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144480
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145C83 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460B7 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021480AE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021410AF TerminateProcess,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460D0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021444DD
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021448DA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145CDB NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B8C4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143CC1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021444FA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021460E7 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02147CE1 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142CE9
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143D0A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214412D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A175 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214597F NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145D62 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143D6C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02146196 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02145DDF NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021425D8
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214ADCA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143DE2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021441EA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A5EB NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566056
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566C5E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056644E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056804F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056404A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056487E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056807A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563C6C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564816
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A018
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566002
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056800E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566C0E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A435
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566822
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566CD6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005644DD
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005648DA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565CDB
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B8C4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563CC1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005644FA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005660E7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567CE1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562CE9
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566892
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565C83
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564480
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00567081
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005664A6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005680AE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005610AF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566548
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A175
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056597F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00560D67
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565D62
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563D6C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B51C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563D0A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056412D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005625D8
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005665C6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056ADCA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565DE6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563DE2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005641EA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A5EB
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561190
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056699E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B9B2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005665AF
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563E51
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565E51
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566644
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566672
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056567C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BA6E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BA1E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566A0A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056D609
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566233
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056423A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565E3A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BAD6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005666F6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565AFA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566AEA
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565A86
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566286
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562682
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00566A8E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565EBE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005642A2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564AA2
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565B56
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056635A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564B4E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056476E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056636E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564B1F
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056231C
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563F1A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562302
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056430E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056630B
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056473D
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00568724
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565F2E
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056BB28
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005663DE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563FF7
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565BE6
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564396
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00565F9A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005647BE
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005653A1
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005647AD

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 000000000214A419 second address: 000000000214A419 instructions:
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002145B95 second address: 0000000002145B95 instructions:
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002146DA5 second address: 0000000002146DA5 instructions:
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002146E01 second address: 0000000002146E6E instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov edx, 98501FA3h 0x0000000f sub edx, FDFB34E1h 0x00000015 cmp dh, 00000011h 0x00000018 xor edx, E50871A7h 0x0000001e cmp bx, ax 0x00000021 sub edx, 7F5C9B65h 0x00000027 cmp edx, ecx 0x00000029 cmp eax, edx 0x0000002b mov edx, dword ptr [ebp+000001D6h] 0x00000031 jne 00007FD770B76457h 0x00000037 test dx, bx 0x0000003a nop 0x0000003b mov ebx, dword ptr [ebp+20h] 0x0000003e add ebx, 00004100h 0x00000044 mov eax, dword ptr [ebp+00000104h] 0x0000004a mov dword ptr [ebx+000000B8h], eax 0x00000050 mov dword ptr [ebp+000001B9h], esi 0x00000056 jmp 00007FD770B76356h 0x00000058 pushad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002146E6E second address: 0000000002146E6E instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	File opened: C:\Program Files\qga\qga.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Weemaes B.V.-PO74748392.exe, 00000000.00000002.1006564942.0000000002120000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSVBVM60.DLL
Source: Weemaes B.V.-PO74748392.exe, 00000000.00000002.1006564942.0000000002120000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002140135 second address: 0000000002140160 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b jmp 00007FD770B6A38Ah 0x0000000d pushad 0x0000000e mov eax, 000000FDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 000000000214B063 second address: 000000000214B136 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b test edx, 9428169Fh 0x00000011 cmp esi, edi 0x00000013 mov edi, dword ptr [ebp+000001BEh] 0x00000019 je 00007FD770B76AA9h 0x0000001f push 3343CA3Bh 0x00000024 jmp 00007FD770B76356h 0x00000026 test dh, ch 0x00000028 xor dword ptr [esp], 478B418Dh 0x0000002f cmp edx, 82262C5Fh 0x00000035 sub dword ptr [esp], 2EB968E3h 0x0000003c xor dword ptr [esp], 460F22D3h 0x00000043 cmp ebx, ebx 0x00000045 cmp dl, 0000002Ah 0x00000048 test ebx, edx 0x0000004a push 1ACA19CEh 0x0000004f cmp ch, ch 0x00000051 xor dword ptr [esp], A03EEE6Ah 0x00000058 pushad 0x00000059 mov di, 3215h 0x0000005d cmp di, 3215h 0x00000062 jne 00007FD770B75079h 0x00000068 popad 0x00000069 xor dword ptr [esp], 7AA2B45Eh 0x00000070 sub dword ptr [esp], C05643DEh 0x00000077 test cl, bl 0x00000079 mov dword ptr [ebp+0000023Bh], ecx 0x0000007f mov ecx, edi 0x00000081 push ecx 0x00000082 mov ecx, dword ptr [ebp+0000023Bh] 0x00000088 jmp 00007FD770B7635Ah 0x0000008a test ah, dh 0x0000008c test dh, ah 0x0000008e test eax, eax 0x00000090 mov dword ptr [ebp+00000180h], edx 0x00000096 mov edx, 92B25D48h 0x0000009b cmp bl, al 0x0000009d xor edx, 7EFE344Eh 0x000000a3 pushad 0x000000a4 lfence 0x000000a7 rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 000000000214A8D1 second address: 000000000214AD3D instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b test dl, dl 0x0000000d xor ecx, 90DF1B83h 0x00000013 cmp cx, ax 0x00000016 test ah, ah 0x00000018 xor ecx, F680A7B6h 0x0000001e test eax, ecx 0x00000020 nop 0x00000021 xor ecx, BC0BF375h 0x00000027 test ecx, ebx 0x00000029 test dl, cl 0x0000002b cmp cx, ax 0x0000002e mov dword ptr [ebp+00000187h], esi 0x00000034 test ah, ah 0x00000036 mov esi, ecx 0x00000038 test eax, ecx 0x0000003a push esi 0x0000003b nop 0x0000003c mov esi, dword ptr [ebp+00000187h] 0x00000042 jmp 00007FD770B6A386h 0x00000044 test dx, cx 0x00000047 test dl, cl 0x00000049 call 00007FD770B6A4D5h 0x0000004e call 00007FD770B6A617h 0x00000053 lfence 0x00000056 rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 000000000214AD3D second address: 000000000214AD3D instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, 438A76AEh 0x00000013 xor eax, 68233658h 0x00000018 add eax, 13769C0Fh 0x0000001d sub eax, 3F1FDD04h 0x00000022 cpuid 0x00000024 jmp 00007FD770B76356h 0x00000026 pushad 0x00000027 mov eax, 0000004Fh 0x0000002c cpuid 0x0000002e popad 0x0000002f bt ecx, 1Fh 0x00000033 jc 00007FD770B76D2Eh 0x00000039 cmp ebx, edx 0x0000003b jmp 00007FD770B7635Ah 0x0000003d cmp cl, cl 0x0000003f popad 0x00000040 call 00007FD770B76581h 0x00000045 lfence 0x00000048 rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 000000000214BBDB second address: 000000000214BC4F instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 sub byte ptr [eax+09h], FFFFFFAAh 0x00000007 test dl, bl 0x00000009 mov byte ptr [eax+0Ah], FFFFFF95h 0x0000000d push ss 0x0000000e pop ss 0x0000000f jmp 00007FD770B6A386h 0x00000011 cmp bh, ch 0x00000013 xor byte ptr [eax+0Ah], 0000007Dh 0x00000017 cmp ax, 0000E6C6h 0x0000001b test ax, ax 0x0000001e xor byte ptr [eax+0Ah], FFFFFFAFh 0x00000022 add byte ptr [eax+0Ah], FFFFFFBDh 0x00000026 cmp edx, ebx 0x00000028 mov byte ptr [eax+0Bh], 00000005h 0x0000002c test ch, FFFFFF91h 0x0000002f test ah, bh 0x00000031 sub byte ptr [eax+0Bh], 00000072h 0x00000035 xor byte ptr [eax+0Bh], FFFFFFDDh 0x00000039 cmp ax, ax 0x0000003c sub byte ptr [eax+0Bh], 0000004Eh 0x00000040 jmp 00007FD770B6A386h 0x00000042 test ax, dx 0x00000045 test dx, dx 0x00000048 pushad 0x00000049 lfence 0x0000004c rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 000000000214A419 second address: 000000000214A419 instructions:
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 000000000214132D second address: 000000000214A17B instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov dword ptr [ebp+0000021Bh], ebx 0x00000011 mov ebx, esi 0x00000013 push ebx 0x00000014 mov ebx, dword ptr [ebp+0000021Bh] 0x0000001a push ss 0x0000001b pop ss 0x0000001c jmp 00007FD770B6A37Eh 0x0000001e test ch, ah 0x00000020 add edi, 000000FFh 0x00000026 cmp bh, ch 0x00000028 mov dword ptr [ebp+000001F6h], esi 0x0000002e mov esi, edi 0x00000030 push esi 0x00000031 jmp 00007FD770B6A38Ah 0x00000033 test cx, dx 0x00000036 mov esi, dword ptr [ebp+000001F6h] 0x0000003c cmp ah, ch 0x0000003e cmp bx, ax 0x00000041 call 00007FD770B73153h 0x00000046 pushad 0x00000047 mov esi, 00000037h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002145ADB second address: 0000000002145B95 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b test ebx, eax 0x0000000d push dword ptr [ebp+24h] 0x00000010 push 4305DBF6h 0x00000015 sub dword ptr [esp], 353DDF0Bh 0x0000001c jmp 00007FD770B7635Ah 0x0000001e test ecx, ebx 0x00000020 xor dword ptr [esp], A11F1182h 0x00000027 test ax, dx 0x0000002a xor dword ptr [esp], ACD8ED69h 0x00000031 push 2B6511BBh 0x00000036 cmp bl, bl 0x00000038 add dword ptr [esp], CCB58C56h 0x0000003f test ch, FFFFFFCCh 0x00000042 add dword ptr [esp], 223B4A72h 0x00000049 cmp ah, FFFFFFC6h 0x0000004c add dword ptr [esp], E5AA177Dh 0x00000053 test bl, cl 0x00000055 mov dword ptr [ebp+000001A1h], ecx 0x0000005b mov ecx, 0A2D9D02h 0x00000060 jmp 00007FD770B7635Ah 0x00000062 cmp esi, FD2C9FCDh 0x00000068 xor ecx, 7F113666h 0x0000006e xor ecx, DB36DDE1h 0x00000074 pushad 0x00000075 mov ah, D4h 0x00000077 cmp ah, FFFFFFD4h 0x0000007a jne 00007FD770B76238h 0x00000080 popad 0x00000081 cmp dl, dl 0x00000083 xor ecx, AE0A7685h 0x00000089 pushad 0x0000008a rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002145B95 second address: 0000000002145B95 instructions:
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 00000000021499C9 second address: 00000000021499C9 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b call 00007FD770B766CAh 0x00000010 test ax, bx 0x00000013 mov ebx, dword ptr [esp+04h] 0x00000017 xor ecx, ecx 0x00000019 test dl, 00000056h 0x0000001c add ecx, 02h 0x0000001f cmp word ptr [ebx+ecx], 0000h 0x00000024 jne 00007FD770B76338h 0x00000026 add ecx, 02h 0x00000029 cmp word ptr [ebx+ecx], 0000h 0x0000002e jne 00007FD770B76338h 0x00000030 add ecx, 02h 0x00000033 cmp word ptr [ebx+ecx], 0000h 0x00000038 jne 00007FD770B76338h 0x0000003a add ecx, 02h 0x0000003d cmp word ptr [ebx+ecx], 0000h 0x00000042 jne 00007FD770B76338h 0x00000044 add ecx, 02h 0x00000047 cmp word ptr [ebx+ecx], 0000h 0x0000004c jne 00007FD770B76338h 0x0000004e add ecx, 02h 0x00000051 cmp word ptr [ebx+ecx], 0000h 0x00000056 jne 00007FD770B76338h 0x00000058 add ecx, 02h 0x0000005b cmp word ptr [ebx+ecx], 0000h 0x00000060 jne 00007FD770B76338h 0x00000062 retn 0004h 0x00000065 sub ecx, 02h 0x00000068 add eax, 02h 0x0000006b jmp 00007FD770B76356h 0x0000006d test bl, 00000007h 0x00000070 mov bx, word ptr [eax+ecx] 0x00000074 mov dx, word ptr [esi+ecx] 0x00000078 cmp bx, dx 0x0000007b jne 00007FD770B762FEh 0x0000007d push dword ptr [esp+04h] 0x00000081 pushad 0x00000082 lfence 0x00000085 rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002146DA5 second address: 0000000002146DA5 instructions:
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002146E01 second address: 0000000002146E6E instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov edx, 98501FA3h 0x0000000f sub edx, FDFB34E1h 0x00000015 cmp dh, 00000011h 0x00000018 xor edx, E50871A7h 0x0000001e cmp bx, ax 0x00000021 sub edx, 7F5C9B65h 0x00000027 cmp edx, ecx 0x00000029 cmp eax, edx 0x0000002b mov edx, dword ptr [ebp+000001D6h] 0x00000031 jne 00007FD770B76457h 0x00000037 test dx, bx 0x0000003a nop 0x0000003b mov ebx, dword ptr [ebp+20h] 0x0000003e add ebx, 00004100h 0x00000044 mov eax, dword ptr [ebp+00000104h] 0x0000004a mov dword ptr [ebx+000000B8h], eax 0x00000050 mov dword ptr [ebp+000001B9h], esi 0x00000056 jmp 00007FD770B76356h 0x00000058 pushad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000002146E6E second address: 0000000002146E6E instructions:
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 0000000000560135 second address: 0000000000560160 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b jmp 00007FD770B7635Ah 0x0000000d pushad 0x0000000e mov eax, 000000FDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	RDTSC instruction interceptor: First address: 000000000056B063 second address: 000000000056B136 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b test edx, 9428169Fh 0x00000011 cmp esi, edi 0x00000013 mov edi, dword ptr [ebp+000001BEh] 0x00000019 je 00007FD770B6AAD9h 0x0000001f push 3343CA3Bh 0x00000024 jmp 00007FD770B6A386h 0x00000026 test dh, ch 0x00000028 xor dword ptr [esp], 478B418Dh 0x0000002f cmp edx, 82262C5Fh 0x00000035 sub dword ptr [esp], 2EB968E3h 0x0000003c xor dword ptr [esp], 460F22D3h 0x00000043 cmp ebx, ebx 0x00000045 cmp dl, 0000002Ah 0x00000048 test ebx, edx 0x0000004a push 1ACA19CEh 0x0000004f cmp ch, ch 0x00000051 xor dword ptr [esp], A03EEE6Ah 0x00000058 pushad 0x00000059 mov di, 3215h 0x0000005d cmp di, 3215h 0x00000062 jne 00007FD770B690A9h 0x00000068 popad 0x00000069 xor dword ptr [esp], 7AA2B45Eh 0x00000070 sub dword ptr [esp], C05643DEh 0x00000077 test cl, bl 0x00000079 mov dword ptr [ebp+0000023Bh], ecx 0x0000007f mov ecx, edi 0x00000081 push ecx 0x00000082 mov ecx, dword ptr [ebp+0000023Bh] 0x00000088 jmp 00007FD770B6A38Ah 0x0000008a test ah, dh 0x0000008c test dh, ah 0x0000008e test eax, eax 0x00000090 mov dword ptr [ebp+00000180h], edx 0x00000096 mov edx, 92B25D48h 0x0000009b cmp bl, al 0x0000009d xor edx, 7EFE344Eh 0x000000a3 pushad 0x000000a4 lfence 0x000000a7 rdtsc

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Code function: 0_2_02140827 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Weemaes B.V.-PO74748392.exe, 00000000.00000002.1006564942.0000000002120000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32TEMP=windir=\syswow64\msvbvm60.dll
Source: Weemaes B.V.-PO74748392.exe, 00000000.00000002.1006564942.0000000002120000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

System information queried: ModuleInformation

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Process Stats: CPU usage > 90% for more than 60s

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Show sources

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214423A Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143E51 Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021442A2 Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142AC6 Start: 02142BBB End: 02142BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143F1A Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214430E Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214473D Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144396 Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143FF7 Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214404A Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144480 Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021444DD Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021444FA Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214293A Start: 02142BBB End: 02142BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214412D Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02142928 Start: 02142BBB End: 02142BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214298A Start: 02142BBB End: 02142BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021429F8 Start: 02142BBB End: 02142BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143DE2 Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021441EA Start: 02144526 End: 0214453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056404A Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005644DD Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005644FA Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564480 Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056293A Start: 00562BBB End: 00562BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056412D Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562928 Start: 00562BBB End: 00562BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005629F8 Start: 00562BBB End: 00562BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563DE2 Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005641EA Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056298A Start: 00562BBB End: 00562BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563E51 Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056423A Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00562AC6 Start: 00562BBB End: 00562BD4
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005642A2 Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563F1A Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056430E Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056473D Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563FF7 Start: 00564526 End: 0056453A
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564396 Start: 00564526 End: 0056453A

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Code function: 0_2_02140827 rdtsc

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Code function: 0_2_02148BF9 LdrInitializeThunk,

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B51C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02141190 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144AA2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021472D6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144B1F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144B4E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021473B1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021473A2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02144BC8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02143C6C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_021410AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214B8C4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_02149DE5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 0_2_0214A5EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00563C6C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B8C4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005610AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056B51C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00569DE5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_0056A5EB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00561190 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564AA2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564B4E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564B1F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_00564BC8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe	Code function: 18_2_005673B1 mov eax, dword ptr fs:[00000030h]

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Process created: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe 'C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe'

Source: Weemaes B.V.-PO74748392.exe, 00000012.00000002.1741093700.0000000000FA0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Weemaes B.V.-PO74748392.exe, 00000012.00000002.1741093700.0000000000FA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Weemaes B.V.-PO74748392.exe, 00000012.00000002.1741093700.0000000000FA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Weemaes B.V.-PO74748392.exe, 00000012.00000002.1741093700.0000000000FA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Code function: 0_2_02145A2A cpuid

Source: C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe

Queries volume information: C:\ VolumeInformation

Stealing of Sensitive Information:

GuLoader behavior detected

Show sources

Source: Initial file

Signature Results: GuLoader behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion311	OS Credential Dumping	Security Software Discovery721	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion311	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery322	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Weemaes B.V.-PO74748392.exe	36%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://rossettlee.ddnsgeek.com/x/5bab0b1d864615bab0b1d864b3/2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://rossettlee.ddnsgeek.com/x/5bab0b1d864615bab0b1d864b3/2	true	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458358
Start date:	03.08.2021
Start time:	09:51:24
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 35s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Weemaes B.V.-PO74748392.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Suspected Instruction Hammering Hide Perf
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 10.2% (good quality ratio 4.7%) Quality average: 31.3% Quality standard deviation: 37.9%
HCA Information:	Successful, ratio: 68% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, RuntimeBroker.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.023550955444461
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Weemaes B.V.-PO74748392.exe
File size:	148824
MD5:	a08f23a15ef10b17370668cf5b9947ad
SHA1:	7cc53628714dd9d69881be1d186adf7b3e7af9cd
SHA256:	cc8e7690934b9059a1613d246a6c933df5dd7b1e333038dc76f7839dcc5697cd
SHA512:	3856222ba3b1f19abe6658edd081e2be5f3bfea12542f6bc4da54ab0396abd97f177a8c0857b8501f19e2addb2c3d4f1429d63e086bb13d27ae819b7aa784287
SSDEEP:	3072:7YIocqttkj0ufJOWJDZZWUVEZj9GQMUqxfKQX+Zz5U:8IlqtIA83WUVEZj9GQMUqxfKQuZz5U
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L....C.H.....................p......`.............@................

File Icon


Icon Hash:	f092d47154d692f0

Static PE Info

General
Entrypoint:	0x401460
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x48164384 [Mon Apr 28 21:37:08 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3f04be9c844308940905412ae6398e70

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Bojarers4@YNGELPLEJERNE.Dec, CN=KOMMUNIKATIONSPORT, OU=FORVRELSERS, O=Smugkroernes7, L=DISILLUSIONIST, S=underthane, C=SZ
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	8/3/2021 12:42:32 AM 8/3/2022 12:42:32 AM
Subject Chain	E=Bojarers4@YNGELPLEJERNE.Dec, CN=KOMMUNIKATIONSPORT, OU=FORVRELSERS, O=Smugkroernes7, L=DISILLUSIONIST, S=underthane, C=SZ
Version:	3
Thumbprint MD5:	FBE54C5E9F4823869F0A4679D90E0A7F
Thumbprint SHA-1:	06527A5BDEB0338B966DE1A96DB2ADCE4BB32D18
Thumbprint SHA-256:	C9FD39A34B58F4B82A00777D99B72B82EEA9A4BEC7DB78568EEA00B0A60A5578
Serial:	00

Entrypoint Preview

Instruction
push 00417624h
call 00007FD770CEB733h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ah
and edx, dword ptr [ecx+2Dh]
dec ebx
test byte ptr [ecx+2953AB48h], ah
dec eax
mov al, 5Dh
daa
xor al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+61h], al
insb
insb
jo 00007FD770CEB7B5h
jnc 00007FD770CEB7B6h
jc 00007FD770CEB743h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
and eax, F3F110E9h
pop esp
cmp byte ptr [edi-3C237BBCh], dl
adc dl, byte ptr [ecx+51A4A65Ah]
jmp far 46A0h : C6F9A0ECh
mov dh, 14h
rcl dword ptr [edi-5E3023AAh], cl
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xchg eax, ebx
pushad
add dword ptr [eax], eax
aaa
pop eax
add byte ptr [eax], al
add byte ptr [esi], cl
add byte ptr [ebx+55h], dl
inc ebx
inc ebx
inc ebp
push ebx
push ebx
dec ecx
dec edi
dec esi
inc ebp
push edx
dec esi
inc ebp
add byte ptr [4F000C01h], cl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1b634	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d000	0x5b9e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x23000	0x1558
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x138	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1ab34	0x1b000	False	0.488389756944	data	6.47586194473	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1c000	0xaac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1d000	0x5b9e	0x6000	False	0.213745117188	data	3.87033603675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x21cf6	0xea8	data
RT_ICON	0x2144e	0x8a8	data
RT_ICON	0x20ee6	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x1e93e	0x25a8	data
RT_ICON	0x1d896	0x10a8	data
RT_ICON	0x1d42e	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1d3d4	0x5a	data
RT_VERSION	0x1d1e0	0x1f4	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaHresultCheck, __vbaAryMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaVar2Vec, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaAryCopy, __vbaStrMove, _allmul, _CItan, __vbaFPInt, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
ProductVersion	1.00
InternalName	PROKURAERS
FileVersion	1.00
OriginalFilename	PROKURAERS.exe
ProductName	Ballepresser

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: Weemaes B.V.-PO74748392.exe PID: 6728 Parent PID: 5920

General

Start time:	09:52:17
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe'
Imagebase:	0x400000
File size:	148824 bytes
MD5 hash:	A08F23A15EF10B17370668CF5B9947AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1006583828.0000000002140000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: Weemaes B.V.-PO74748392.exe PID: 5960 Parent PID: 6728

General

Start time:	09:54:59
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Weemaes B.V.-PO74748392.exe'
Imagebase:	0x400000
File size:	148824 bytes
MD5 hash:	A08F23A15EF10B17370668CF5B9947AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000012.00000002.1740602938.0000000000560000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Weemaes B.V.-PO74748392.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: Weemaes B.V.-PO74748392.exe PID: 6728 Parent PID: 5920

General

Analysis Process: Weemaes B.V.-PO74748392.exe PID: 5960 Parent PID: 6728

General

Disassembly

Code Analysis