Windows Analysis Report W7UbgU8x18

Overview

General Information

Sample Name: W7UbgU8x18 (renamed file extension from none to exe)
Analysis ID: 528611
MD5: 01f140fea9669403791fb89c47138d69
SHA1: c4278cf25da52adc05f4d2161a11c7b96928ccea
SHA256: f135fdb20bb785afb947173d0bbfdfedd1ce5b8c4907f6aa37e9a9a706d8a1db
Tags: 32AgentTeslaexetrojan
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Allocates memory in foreign processes
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Binary contains a suspicious time stamp
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0.0.W7UbgU8x18.exe.3938940.7.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "oazahotel@oazahotel.com.mk", "Password": "Oazah2020", "Host": "odin.mk-host.com"}
Multi AV Scanner detection for submitted file
Source: W7UbgU8x18.exe Virustotal: Detection: 35% Perma Link
Source: W7UbgU8x18.exe ReversingLabs: Detection: 28%
Machine Learning detection for sample
Source: W7UbgU8x18.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 2.0.aspnet_regbrowsers.exe.400000.3.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.aspnet_regbrowsers.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.aspnet_regbrowsers.exe.400000.1.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.aspnet_regbrowsers.exe.400000.2.unpack Avira: Label: TR/Spy.Gen8
Source: 2.2.aspnet_regbrowsers.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.aspnet_regbrowsers.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: W7UbgU8x18.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: rsaenh.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb""9s source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: System.ni.pdb% source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdb" source: WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000A.00000003.270613865.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270476484.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.283477132.000000000501C000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270318610.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271099127.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270669562.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270533710.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271835064.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270427827.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: tuneraidfix.pdb" source: WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp
Source: Binary string: t.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: cfgmgr32.pdb, source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000A.00000003.271728501.0000000003125000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270300201.0000000003125000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: ore.ni.pdb" source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: profapi.pdb6 source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: fixedhost.pdb\ source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: clr.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: .ni.pdb source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: cryptsp.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb" source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: System.Configuration.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\exe\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000A.00000003.271474632.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270327702.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270696517.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271114110.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: System.Xml.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: mscoree.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdbT3|n source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Builder\stub\1605780553\un_priv\tuneraidfix\obj\Release\tuneraidfix.pdb source: W7UbgU8x18.exe
Source: Binary string: fixedhost.pdbMZ@ source: WER343.tmp.dmp.10.dr
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Z.pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER343.tmp.dmp.10.dr
Source: Binary string: System.Configuration.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: wsspicli.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb* source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: msasn1.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: tuneraidfix.pdb4 source: WER343.tmp.dmp.10.dr
Source: Binary string: mscorlib.pdb source: W7UbgU8x18.exe, 00000000.00000000.256471113.00000000028DD000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: C:\Windows\tuneraidfix.pdbpdbfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: clrjit.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.285188895.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284978604.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285080721.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000A.00000003.270318610.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271099127.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270669562.0000000003131000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WER343.tmp.dmp.10.dr
Source: Binary string: C:\Users\Administrator\Desktop\Builder\stub\1605780553\un_priv\tuneraidfix\obj\Release\tuneraidfix.pdbP source: W7UbgU8x18.exe, 00000000.00000000.256076792.0000000000C18000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000002.302604429.0000000000C18000.00000004.00000020.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: System.Xml.ni.pdbRSDS source: WER343.tmp.dmp.10.dr
Source: Binary string: C:\Users\user\Desktop\W7UbgU8x18.PDB source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: winhttp.pdbW source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: t.pdb" source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: System.Core.ni.pdbRSDSD source: WER343.tmp.dmp.10.dr
Source: Binary string: dhcpcsvc.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: diasymreader.pdb_ source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: W7UbgU8x18.PDB source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: mscorlib.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: mscoreei.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: t.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb% source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc6.pdbK source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: lC:\Users\user\Desktop\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: tuneraidfix.pdb source: WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: C:\Users\Administrator\Desktop\Builder\stub\1605780553\un_priv\tuneraidfix\obj\Release\tuneraidfix.pdb:8 source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdbT source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: diasymreader.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: psapi.pdb; source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: winhttp.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdb% source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: rtutils.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: D .pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000A.00000003.271728501.0000000003125000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270300201.0000000003125000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc6.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdbRSDS source: WER343.tmp.dmp.10.dr
Source: Binary string: clrjit.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Xml.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: wmswsock.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: version.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wintrust.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.pdbMZ source: WER343.tmp.dmp.10.dr
Source: Binary string: System.Xml.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: System.pdb source: W7UbgU8x18.exe, 00000000.00000000.256471113.00000000028DD000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: ore.ni.pdb source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: tuneraidfix.pdb<qA source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: fixedhost.pdb source: W7UbgU8x18.exe, 00000000.00000000.261864579.0000000002860000.00000004.00020000.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: System.Core.pdbq source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\tuneraidfix.pdb] source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: psapi.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000A.00000003.271474632.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270327702.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270696517.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271114110.0000000003137000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: mscoreei.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 0000000A.00000003.285188895.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284978604.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285080721.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: System.Xml.ni.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Zsymbols\exe\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: l8C:\Windows\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbi source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb" source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: cryptbase.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp

Networking:

barindex
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: 24SHELLSUS 24SHELLSUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /token_ta992i.txt HTTP/1.1Host: 194.85.248.219Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /publickey.txt HTTP/1.1Host: 194.85.248.219
Source: global traffic HTTP traffic detected: GET /token_ta992i.txt HTTP/1.1Host: 194.85.248.219
Source: global traffic HTTP traffic detected: GET /publickey.txt HTTP/1.1Host: 194.85.248.219
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 209.205.200.74 209.205.200.74
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49817 -> 209.205.200.74:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.5:49817 -> 209.205.200.74:587
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: unknown TCP traffic detected without corresponding DNS query: 194.85.248.219
Source: aspnet_regbrowsers.exe, 00000002.00000002.518302726.0000000003231000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: W7UbgU8x18.exe, 00000000.00000002.303285101.0000000002881000.00000004.00000001.sdmp String found in binary or memory: http://194.85.248.219
Source: W7UbgU8x18.exe, 00000000.00000002.303457973.00000000028B2000.00000004.00000001.sdmp String found in binary or memory: http://194.85.248.219/publickey.txt
Source: W7UbgU8x18.exe, 00000000.00000000.256041961.0000000000BF9000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000002.303285101.0000000002881000.00000004.00000001.sdmp String found in binary or memory: http://194.85.248.219/token_ta992i.txt
Source: aspnet_regbrowsers.exe, 00000002.00000002.518302726.0000000003231000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: aspnet_regbrowsers.exe, 00000002.00000002.520908081.0000000006CC0000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca
Source: aspnet_regbrowsers.exe, 00000002.00000002.519514145.000000000358E000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.516444584.00000000013E1000.00000004.00000020.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: aspnet_regbrowsers.exe, 00000002.00000002.516444584.00000000013E1000.00000004.00000020.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: aspnet_regbrowsers.exe, 00000002.00000002.519514145.000000000358E000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.516444584.00000000013E1000.00000004.00000020.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: aspnet_regbrowsers.exe, 00000002.00000002.519514145.000000000358E000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.520908081.0000000006CC0000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.516444584.00000000013E1000.00000004.00000020.sdmp String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: WerFault.exe, 0000000A.00000002.300722840.0000000004F20000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: aspnet_regbrowsers.exe, 00000002.00000002.519418805.000000000354A000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000003.465831512.00000000011A4000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.519494646.0000000003588000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.518302726.0000000003231000.00000004.00000001.sdmp String found in binary or memory: http://m3kI8gc4jNB3oWFQtMC.org
Source: aspnet_regbrowsers.exe, 00000002.00000002.519514145.000000000358E000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.516444584.00000000013E1000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: aspnet_regbrowsers.exe, 00000002.00000002.519514145.000000000358E000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.520908081.0000000006CC0000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.516444584.00000000013E1000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com01
Source: aspnet_regbrowsers.exe, 00000002.00000002.519514145.000000000358E000.00000004.00000001.sdmp String found in binary or memory: http://odin.mk-host.com
Source: aspnet_regbrowsers.exe, 00000002.00000002.518302726.0000000003231000.00000004.00000001.sdmp String found in binary or memory: http://sGexjS.com
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: W7UbgU8x18.exe, 00000000.00000002.303285101.0000000002881000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 0000000A.00000003.282359280.00000000057F0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
Source: Amcache.hve.10.dr String found in binary or memory: http://upx.sf.net
Source: aspnet_regbrowsers.exe, 00000002.00000002.519514145.000000000358E000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.520908081.0000000006CC0000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.516444584.00000000013E1000.00000004.00000020.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: W7UbgU8x18.exe, 00000000.00000002.307259101.00000000038AA000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000000.249733386.0000000000402000.00000040.00000001.sdmp, aspnet_regbrowsers.exe, 00000002.00000000.249428029.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: aspnet_regbrowsers.exe, 00000002.00000002.518302726.0000000003231000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: odin.mk-host.com
Source: global traffic HTTP traffic detected: GET /token_ta992i.txt HTTP/1.1Host: 194.85.248.219Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /publickey.txt HTTP/1.1Host: 194.85.248.219
Source: global traffic HTTP traffic detected: GET /token_ta992i.txt HTTP/1.1Host: 194.85.248.219
Source: global traffic HTTP traffic detected: GET /publickey.txt HTTP/1.1Host: 194.85.248.219

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: W7UbgU8x18.exe, 00000000.00000000.261051389.0000000000B7A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

barindex
.NET source code contains very large array initializations
Source: 2.0.aspnet_regbrowsers.exe.400000.3.unpack, u003cPrivateImplementationDetailsu003eu007b51F4FAD8u002dC68Cu002d48D5u002d8048u002dB546FD1BA033u007d/BD7250DBu002dF98Du002d47A7u002d866Cu002d6BD9A3781D1C.cs Large array initialization: .cctor: array initializer size 11957
Source: 2.0.aspnet_regbrowsers.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b51F4FAD8u002dC68Cu002d48D5u002d8048u002dB546FD1BA033u007d/BD7250DBu002dF98Du002d47A7u002d866Cu002d6BD9A3781D1C.cs Large array initialization: .cctor: array initializer size 11957
Source: 2.0.aspnet_regbrowsers.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b51F4FAD8u002dC68Cu002d48D5u002d8048u002dB546FD1BA033u007d/BD7250DBu002dF98Du002d47A7u002d866Cu002d6BD9A3781D1C.cs Large array initialization: .cctor: array initializer size 11957
Source: 2.0.aspnet_regbrowsers.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007b51F4FAD8u002dC68Cu002d48D5u002d8048u002dB546FD1BA033u007d/BD7250DBu002dF98Du002d47A7u002d866Cu002d6BD9A3781D1C.cs Large array initialization: .cctor: array initializer size 11957
Source: 2.2.aspnet_regbrowsers.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b51F4FAD8u002dC68Cu002d48D5u002d8048u002dB546FD1BA033u007d/BD7250DBu002dF98Du002d47A7u002d866Cu002d6BD9A3781D1C.cs Large array initialization: .cctor: array initializer size 11957
Source: 2.0.aspnet_regbrowsers.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b51F4FAD8u002dC68Cu002d48D5u002d8048u002dB546FD1BA033u007d/BD7250DBu002dF98Du002d47A7u002d866Cu002d6BD9A3781D1C.cs Large array initialization: .cctor: array initializer size 11957
One or more processes crash
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 1396
Detected potential crypto function
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_02721B00 0_2_02721B00
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_0272A090 0_2_0272A090
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_02723D40 0_2_02723D40
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_027271C0 0_2_027271C0
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_027271BC 0_2_027271BC
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_02724770 0_2_02724770
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_0272476B 0_2_0272476B
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_0272D518 0_2_0272D518
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_02723D0F 0_2_02723D0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0169B748 2_2_0169B748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_01696BE0 2_2_01696BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_016B0040 2_2_016B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_016B33F8 2_2_016B33F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_016B8960 2_2_016B8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_016B0CF0 2_2_016B0CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_016B0006 2_2_016B0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_01824800 2_2_01824800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_018281C0 2_2_018281C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_01824710 2_2_01824710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0182D6D0 2_2_0182D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646059E 2_2_0646059E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646B208 2_2_0646B208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464B88 2_2_06464B88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06469908 2_2_06469908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_064676B0 2_2_064676B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646E588 2_2_0646E588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_064653D0 2_2_064653D0
Sample file is different than original file name gathered from version info
Source: W7UbgU8x18.exe Binary or memory string: OriginalFilename vs W7UbgU8x18.exe
Source: W7UbgU8x18.exe, 00000000.00000002.307259101.00000000038AA000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameuaAFllYGbTewxRVnYOHBNjJG.exe4 vs W7UbgU8x18.exe
Source: W7UbgU8x18.exe, 00000000.00000000.261051389.0000000000B7A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs W7UbgU8x18.exe
Source: W7UbgU8x18.exe, 00000000.00000002.301512168.0000000000412000.00000002.00020000.sdmp Binary or memory string: OriginalFilenametuneraidfix.exe8 vs W7UbgU8x18.exe
Source: W7UbgU8x18.exe, 00000000.00000002.302293725.0000000000B7A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs W7UbgU8x18.exe
Source: W7UbgU8x18.exe, 00000000.00000000.261864579.0000000002860000.00000004.00020000.sdmp Binary or memory string: OriginalFilenamefixedhost.dll0 vs W7UbgU8x18.exe
Source: W7UbgU8x18.exe, 00000000.00000000.256471113.00000000028DD000.00000004.00000001.sdmp Binary or memory string: OriginalFilenametuneraidfix.exe8 vs W7UbgU8x18.exe
Source: W7UbgU8x18.exe Binary or memory string: OriginalFilenametuneraidfix.exe8 vs W7UbgU8x18.exe
Source: W7UbgU8x18.exe Virustotal: Detection: 35%
Source: W7UbgU8x18.exe ReversingLabs: Detection: 28%
Source: C:\Users\user\Desktop\W7UbgU8x18.exe File read: C:\Users\user\Desktop\W7UbgU8x18.exe Jump to behavior
Source: W7UbgU8x18.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\W7UbgU8x18.exe "C:\Users\user\Desktop\W7UbgU8x18.exe"
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 1396
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER343.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/7@1/2
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1768:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5644
Source: 2.0.aspnet_regbrowsers.exe.400000.3.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.aspnet_regbrowsers.exe.400000.3.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.aspnet_regbrowsers.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.aspnet_regbrowsers.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.aspnet_regbrowsers.exe.400000.1.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.aspnet_regbrowsers.exe.400000.1.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: W7UbgU8x18.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: W7UbgU8x18.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: W7UbgU8x18.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: rsaenh.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb""9s source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: System.ni.pdb% source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdb" source: WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000A.00000003.270613865.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270476484.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.283477132.000000000501C000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270318610.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271099127.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270669562.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270533710.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271835064.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270427827.000000000501B000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: tuneraidfix.pdb" source: WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp
Source: Binary string: t.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: cfgmgr32.pdb, source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000A.00000003.271728501.0000000003125000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270300201.0000000003125000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: ore.ni.pdb" source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: profapi.pdb6 source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: fixedhost.pdb\ source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: clr.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: .ni.pdb source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: cryptsp.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb" source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: System.Configuration.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\exe\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000A.00000003.271474632.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270327702.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270696517.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271114110.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: System.Xml.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: mscoree.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdbT3|n source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Builder\stub\1605780553\un_priv\tuneraidfix\obj\Release\tuneraidfix.pdb source: W7UbgU8x18.exe
Source: Binary string: fixedhost.pdbMZ@ source: WER343.tmp.dmp.10.dr
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Z.pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER343.tmp.dmp.10.dr
Source: Binary string: System.Configuration.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: wsspicli.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb* source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: msasn1.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: tuneraidfix.pdb4 source: WER343.tmp.dmp.10.dr
Source: Binary string: mscorlib.pdb source: W7UbgU8x18.exe, 00000000.00000000.256471113.00000000028DD000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: C:\Windows\tuneraidfix.pdbpdbfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: clrjit.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.285188895.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284978604.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285080721.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000A.00000003.270318610.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271099127.0000000003131000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270669562.0000000003131000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WER343.tmp.dmp.10.dr
Source: Binary string: C:\Users\Administrator\Desktop\Builder\stub\1605780553\un_priv\tuneraidfix\obj\Release\tuneraidfix.pdbP source: W7UbgU8x18.exe, 00000000.00000000.256076792.0000000000C18000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000002.302604429.0000000000C18000.00000004.00000020.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: System.Xml.ni.pdbRSDS source: WER343.tmp.dmp.10.dr
Source: Binary string: C:\Users\user\Desktop\W7UbgU8x18.PDB source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: winhttp.pdbW source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: t.pdb" source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: System.Core.ni.pdbRSDSD source: WER343.tmp.dmp.10.dr
Source: Binary string: dhcpcsvc.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: diasymreader.pdb_ source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: W7UbgU8x18.PDB source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: mscorlib.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: mscoreei.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: t.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb% source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc6.pdbK source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: lC:\Users\user\Desktop\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: tuneraidfix.pdb source: WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: C:\Users\Administrator\Desktop\Builder\stub\1605780553\un_priv\tuneraidfix\obj\Release\tuneraidfix.pdb:8 source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdbT source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: diasymreader.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: psapi.pdb; source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: winhttp.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdb% source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: rtutils.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: D .pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000A.00000003.271728501.0000000003125000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270300201.0000000003125000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc6.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.285031636.0000000005501000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdbRSDS source: WER343.tmp.dmp.10.dr
Source: Binary string: clrjit.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Xml.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: wmswsock.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: version.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: wintrust.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.pdbMZ source: WER343.tmp.dmp.10.dr
Source: Binary string: System.Xml.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: System.pdb source: W7UbgU8x18.exe, 00000000.00000000.256471113.00000000028DD000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: ore.ni.pdb source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: tuneraidfix.pdb<qA source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: fixedhost.pdb source: W7UbgU8x18.exe, 00000000.00000000.261864579.0000000002860000.00000004.00020000.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: System.Core.pdbq source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\tuneraidfix.pdb] source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.285168837.00000000054D0000.00000004.00000040.sdmp
Source: Binary string: psapi.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbx source: WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000A.00000003.271474632.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270327702.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.270696517.0000000003137000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000003.271114110.0000000003137000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: mscoreei.pdb source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 0000000A.00000003.285188895.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284978604.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285080721.00000000054D7000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdb source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: System.Xml.ni.pdb0 source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: Zsymbols\exe\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: l8C:\Windows\tuneraidfix.pdb source: W7UbgU8x18.exe, 00000000.00000002.301641662.00000000005A8000.00000004.00000001.sdmp, W7UbgU8x18.exe, 00000000.00000000.260367500.00000000005A8000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbi source: WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb" source: WerFault.exe, 0000000A.00000003.284933803.00000000054E7000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284964542.00000000054D1000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000002.300956712.00000000057B0000.00000004.00000001.sdmp, WER343.tmp.dmp.10.dr
Source: Binary string: cryptbase.pdbk source: WerFault.exe, 0000000A.00000003.284847253.00000000054D2000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdb source: WerFault.exe, 0000000A.00000003.285204037.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.285099553.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284989581.00000000054DA000.00000004.00000040.sdmp, WerFault.exe, 0000000A.00000003.284866428.00000000054DA000.00000004.00000040.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: W7UbgU8x18.exe, duckclass.cs .Net Code: duckchoiceselector System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.W7UbgU8x18.exe.410000.1.unpack, duckclass.cs .Net Code: duckchoiceselector System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.W7UbgU8x18.exe.410000.0.unpack, duckclass.cs .Net Code: duckchoiceselector System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.W7UbgU8x18.exe.410000.5.unpack, duckclass.cs .Net Code: duckchoiceselector System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.W7UbgU8x18.exe.410000.0.unpack, duckclass.cs .Net Code: duckchoiceselector System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_0272B7B2 push ds; retf 0_2_0272B7B6
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Code function: 0_2_0272545A push ds; retf 0_2_0272545E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_064635A8 push es; iretd 2_2_06463D3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464245 push es; iretd 2_2_06464248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464241 push es; iretd 2_2_06464244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646424D push es; iretd 2_2_06464250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464249 push es; iretd 2_2_0646424C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464255 push es; iretd 2_2_06464258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464251 push es; iretd 2_2_06464254
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646425D push es; iretd 2_2_06464260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464259 push es; iretd 2_2_0646425C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464265 push es; iretd 2_2_06464268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464261 push es; iretd 2_2_06464264
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646426D push es; iretd 2_2_06464270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464269 push es; iretd 2_2_0646426C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464275 push es; iretd 2_2_06464278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464271 push es; iretd 2_2_06464274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646427D push es; iretd 2_2_06464280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464279 push es; iretd 2_2_0646427C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464205 push es; iretd 2_2_06464208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464201 push es; iretd 2_2_06464204
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646420D push es; iretd 2_2_06464210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464209 push es; iretd 2_2_0646420C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464215 push es; iretd 2_2_06464218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464211 push es; iretd 2_2_06464214
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646421D push es; iretd 2_2_06464220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464219 push es; iretd 2_2_0646421C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464225 push es; iretd 2_2_06464228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464221 push es; iretd 2_2_06464224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_0646422D push es; iretd 2_2_06464230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_06464229 push es; iretd 2_2_0646422C
Binary contains a suspicious time stamp
Source: W7UbgU8x18.exe Static PE information: 0xCB1B3270 [Fri Dec 24 07:40:32 2077 UTC]

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 6940 Thread sleep time: -18446744073709540s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 6944 Thread sleep count: 2557 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 6944 Thread sleep count: 7299 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Window / User API: threadDelayed 2557 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Window / User API: threadDelayed 7299 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Amcache.hve.10.dr Binary or memory string: VMware
Source: Amcache.hve.10.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.10.dr Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr Binary or memory string: VMware7,1
Source: Amcache.hve.10.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 0000000A.00000002.300722840.0000000004F20000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.10.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr Binary or memory string: VMware, Inc.me
Source: Amcache.hve.10.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: WerFault.exe, 0000000A.00000002.300816441.0000000005020000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.10.dr Binary or memory string: VMware-42 35 bb 32 33 75 d2 27-52 00 3c e2 4b d4 32 71
Source: W7UbgU8x18.exe, 00000000.00000002.302413121.0000000000BAE000.00000004.00000020.sdmp, W7UbgU8x18.exe, 00000000.00000000.255992862.0000000000BAE000.00000004.00000020.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.516444584.00000000013E1000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.10.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Code function: 2_2_016BCB20 LdrInitializeThunk, 2_2_016BCB20
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 438000 Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 43A000 Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: FD0008 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Jump to behavior
Source: W7UbgU8x18.exe, 00000000.00000000.261554624.0000000001200000.00000002.00020000.sdmp, W7UbgU8x18.exe, 00000000.00000000.256145206.0000000001200000.00000002.00020000.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.517926285.0000000001C30000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: W7UbgU8x18.exe, 00000000.00000000.261554624.0000000001200000.00000002.00020000.sdmp, W7UbgU8x18.exe, 00000000.00000000.256145206.0000000001200000.00000002.00020000.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.517926285.0000000001C30000.00000002.00020000.sdmp Binary or memory string: Progman
Source: W7UbgU8x18.exe, 00000000.00000000.261554624.0000000001200000.00000002.00020000.sdmp, W7UbgU8x18.exe, 00000000.00000000.256145206.0000000001200000.00000002.00020000.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.517926285.0000000001C30000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: W7UbgU8x18.exe, 00000000.00000000.261554624.0000000001200000.00000002.00020000.sdmp, W7UbgU8x18.exe, 00000000.00000000.256145206.0000000001200000.00000002.00020000.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.517926285.0000000001C30000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: W7UbgU8x18.exe, 00000000.00000000.261554624.0000000001200000.00000002.00020000.sdmp, W7UbgU8x18.exe, 00000000.00000000.256145206.0000000001200000.00000002.00020000.sdmp, aspnet_regbrowsers.exe, 00000002.00000002.517926285.0000000001C30000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Queries volume information: C:\Users\user\Desktop\W7UbgU8x18.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\W7UbgU8x18.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.10.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.W7UbgU8x18.exe.3938940.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.W7UbgU8x18.exe.3938940.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.W7UbgU8x18.exe.3938940.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.W7UbgU8x18.exe.3938940.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.W7UbgU8x18.exe.3938940.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.W7UbgU8x18.exe.3938940.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.249733386.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.307259101.00000000038AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.250374714.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.512779528.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.249428029.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.264523511.00000000038AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.250051529.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.258695502.00000000038AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.518302726.0000000003231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: W7UbgU8x18.exe PID: 5644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: aspnet_regbrowsers.exe PID: 408, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000002.00000002.518302726.0000000003231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: aspnet_regbrowsers.exe PID: 408, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.W7UbgU8x18.exe.3938940.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.W7UbgU8x18.exe.3938940.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.W7UbgU8x18.exe.3938940.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.W7UbgU8x18.exe.3938940.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.W7UbgU8x18.exe.3938940.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.aspnet_regbrowsers.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.W7UbgU8x18.exe.3938940.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.249733386.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.307259101.00000000038AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.250374714.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.512779528.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.249428029.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.264523511.00000000038AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.250051529.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.258695502.00000000038AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.518302726.0000000003231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: W7UbgU8x18.exe PID: 5644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: aspnet_regbrowsers.exe PID: 408, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 528611 Sample: W7UbgU8x18 Startdate: 25/11/2021 Architecture: WINDOWS Score: 100 27 Found malware configuration 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected AgentTesla 2->31 33 3 other signatures 2->33 6 W7UbgU8x18.exe 15 3 2->6         started        process3 dnsIp4 23 194.85.248.219, 49722, 80 DATACENTERRO Russian Federation 6->23 35 Writes to foreign memory regions 6->35 37 Allocates memory in foreign processes 6->37 39 Injects a PE file into a foreign processes 6->39 10 aspnet_regbrowsers.exe 2 6->10         started        14 WerFault.exe 23 9 6->14         started        17 conhost.exe 6->17         started        19 aspnet_regbrowsers.exe 6->19         started        signatures5 process6 dnsIp7 25 odin.mk-host.com 209.205.200.74, 49817, 587 24SHELLSUS United States 10->25 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->41 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->43 45 Tries to steal Mail credentials (via file / registry access) 10->45 47 3 other signatures 10->47 21 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 14->21 dropped file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
209.205.200.74
 odin.mk-host.com United States
55081 24SHELLSUS true
194.85.248.219
 unknown Russian Federation
35478 DATACENTERRO false

Contacted Domains

Name IP Active
odin.mk-host.com 209.205.200.74 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://194.85.248.219/token_ta992i.txt false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://194.85.248.219/publickey.txt false
  • Avira URL Cloud: safe
 unknown